Live › vulnerability › CVE-2026-110179
Go to dashboardThe affiliate-toolkit WordPress plugin before 3.8.9 passes an unvalidated sort parameter into a database query on an admin list screen. Users with editor-level access can use this SQL injection to read arbitrary database contents, and on multisite a sub-site editor can read the super administrator's password hash.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running affiliate-toolkit before 3.8.9 where users with editor-level access or above can reach the affected admin list screen. Multisite networks are at higher risk because a sub-site editor can read the network-global users table. Sites without the plugin, or with it already updated, can skip it.
No product ranges from the sources yet.
wp plugin get affiliate-toolkit --field=version3.8.9 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.
This page as .md · .json · in your agent: get_signal("CVE-2026-110179")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.