{"id":"CVE-2026-120043","kind":"vulnerability","aliases":["CVE-2026-120043"],"related":[],"title":"SliceWP Affiliates WordPress plugin: unauthenticated SQL injection via email parameter","description":"The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.2.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is reachable without any account because the vulnerable code path is triggered via the user_register hook fired on every successful WooCommerce My Account registration, which requires only a guest-obtainable nonce.","summary":"The SliceWP Affiliates plugin for WordPress passes the 'email' parameter into an SQL query without proper escaping or preparation, in all versions up to and including 1.2.14. An unauthenticated attacker can append their own SQL queries to existing ones to read sensitive data from the site's database.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"slicewp","fixed":["1.2.15"],"affected":"<= 1.2.14","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["patched-1.2.15","plugin-not-installed","woocommerce-registration-disabled"],"how_to_check":"- WordPress admin > Plugins: if 'Affiliate Program Suite — SliceWP Affiliates' is 1.2.14 or lower, you are on a vulnerable version; 1.2.15 is the patched one.\n- Also check whether WooCommerce My Account registration (customer self-registration) is enabled; the injection fires from the user_register hook on a WooCommerce registration, which needs only a guest-obtainable nonce. Sites without WooCommerce or with registration disabled are less exposed, though update anyway.\n- After updating, look for unfamiliar admin accounts and odd strings in recent users' email fields.","fix":"Update SliceWP Affiliates (slug slicewp) to 1.2.15 or newer.","status":"open","published_at":"2026-11-07T05:18:08+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","triaged_at":"2026-11-07T05:52:08+00:00","updated_at":"2026-11-07T06:27:03+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-07T05:52:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SliceWP Affiliates WordPress plugin: unauthenticated SQL injection via email parameter","impact":"high","summary":"The SliceWP Affiliates plugin for WordPress passes the 'email' parameter into an SQL query without proper escaping or preparation, in all versions up to and including 1.2.14. An unauthenticated attacker can append their own SQL queries to existing ones to read sensitive data from the site's database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker reads sensitive database contents","analyst_note":"Find the fixed plugin version and confirm the WooCommerce registration precondition from the vendor or NVD advisory page at https://nvd.nist.gov/vuln/detail/CVE-2026-120043.","how_to_check":"- Check the installed version of the SliceWP Affiliates plugin in the WordPress admin under Plugins; versions up to and including `1.2.14` are listed as vulnerable.\n- Confirm whether the site uses WooCommerce My Account registration, since the description says the vulnerable path runs on that registration hook.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the SliceWP Affiliates plugin up to and including 1.2.14 are exposed, and the description ties the reachable path to WooCommerce My Account registration, which needs only a guest-obtainable nonce. Sites without this plugin, or with it at a version above 1.2.14 per the sources, are not affected. The sources do not give a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000761,"input_tokens":4355,"output_tokens":651,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed plugin version and confirm the WooCommerce registration precondition from the vendor or NVD advisory page at https://nvd.nist.gov/vuln/detail/CVE-2026-120043.","search":"'-120043':13A,16A '-2026':12A,15A '1.2.14':50B,98C 'account':151C,170C 'addit':127C 'affili':2A,26B,73C,77C 'alreadi':131C 'append':55B,126C 'attack':53B,124C 'code':155C 'cve':11A,14A 'data':66B 'databas':71B,144C 'due':99C 'email':9A,32B,89C 'escap':40B,102C 'everi':166C 'exist':61B,115C,132C 'extract':139C 'fire':164C 'generic':84C 'guest':177C 'guest-obtain':176C 'hook':163C 'host':21B 'includ':49B,97C 'inform':141C 'inject':7A,86C,146C 'insuffici':101C 'lack':109C 'make':119C 'nonc':179C 'obtain':178C 'one':62B 'packag':18B 'paramet':10A,33B,90C,107C 'pass':30B 'path':156C 'plugin':4A,27B,78C 'possibl':121C 'prepar':42B,112C 'program':74C 'proper':39B 'queri':37B,59B,117C,129C,133C 'reachabl':148C 'read':64B 'regist':162C 'registr':171C 'requir':173C 'self':20B 'self-host':19B 'sensit':65B,140C 'site':69B 'slicewp':1A,17A,25B,76C 'sql':6A,36B,58B,85C,116C,128C 'success':167C 'suffici':111C 'suit':75C 'suppli':106C 'trigger':158C 'unauthent':5A,52B,123C 'use':137C 'user':105C,161C 'version':45B,93C 'via':8A,87C,159C 'vulner':82C,154C 'without':38B,149C 'woocommerc':22B,168C 'wordpress':3A,23B,29B,80C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the SliceWP Affiliates plugin (Affiliate Program Suite) version 1.2.14 or earlier. The injection is reached through the user_register hook on a WooCommerce My Account registration, using the 'email' value and a nonce any guest can get, so stores that let visitors register are the ones to look at first. Sites without the plugin, or on 1.2.15+, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["slicewp"],"ptokens":["slicewp"],"labels":["high","package","selfhosted","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-120043':13A,16A '-2026':12A,15A 'affili':2A 'cve':11A,14A 'email':9A 'inject':7A 'paramet':10A 'plugin':4A 'slicewp':1A,17A 'sql':6A 'unauthent':5A 'via':8A 'wordpress':3A","search_b":"'1.2.14':50B 'affili':26B 'append':55B 'attack':53B 'data':66B 'databas':71B 'email':32B 'escap':40B 'exist':61B 'host':21B 'includ':49B 'one':62B 'packag':18B 'paramet':33B 'pass':30B 'plugin':27B 'prepar':42B 'proper':39B 'queri':37B,59B 'read':64B 'self':20B 'self-host':19B 'sensit':65B 'site':69B 'slicewp':25B 'sql':36B,58B 'unauthent':52B 'version':45B 'without':38B 'woocommerc':22B 'wordpress':23B,29B","search_c":"'1.2.14':98C 'account':151C,170C 'addit':127C 'affili':73C,77C 'alreadi':131C 'append':126C 'attack':124C 'code':155C 'databas':144C 'due':99C 'email':89C 'escap':102C 'everi':166C 'exist':115C,132C 'extract':139C 'fire':164C 'generic':84C 'guest':177C 'guest-obtain':176C 'hook':163C 'includ':97C 'inform':141C 'inject':86C,146C 'insuffici':101C 'lack':109C 'make':119C 'nonc':179C 'obtain':178C 'paramet':90C,107C 'path':156C 'plugin':78C 'possibl':121C 'prepar':112C 'program':74C 'queri':117C,129C,133C 'reachabl':148C 'regist':162C 'registr':171C 'requir':173C 'sensit':140C 'slicewp':76C 'sql':85C,116C,128C 'success':167C 'suffici':111C 'suit':75C 'suppli':106C 'trigger':158C 'unauthent':123C 'use':137C 'user':105C,161C 'version':93C 'via':87C,159C 'vulner':82C,154C 'without':149C 'woocommerc':168C 'wordpress':80C","first_public_at":"2026-11-07T05:18:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120043","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120043","severity":null,"published_at":"2026-11-07T05:18:08+00:00","modified_at":"2026-11-07T05:18:11+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","fetched_at":"2026-11-07T05:45:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120043:2080","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slicewp/affiliate-program-suite-1214-unauthenticated-sql-injection-via-email-parameter","severity":null,"published_at":"2026-11-07T06:27:03+00:00","modified_at":"2026-11-07T06:27:03+00:00","first_seen_at":"2026-11-07T06:27:03+00:00","fetched_at":"2026-11-07T06:27:03+00:00","note":"Fixed version 1.2.15 per Wordfence (CVE CNA, researcher Kuba) and Patchstack; WooCommerce registration precondition confirmed on Wordfence. Vendor's own changelog not read (wordpress.org page didn't show it), so nothing marked verified. Patchstack page claims KEV/known exploited, with no corroboration, so exploited left false. No PoC found; no X search done.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slicewp/affiliate-program-suite-1214-unauthenticated-sql-injection-via-email-parameter","https://patchstack.com/database/wordpress/plugin/slicewp/vulnerability/wordpress-affiliate-program-suite-slicewp-affiliates-plugin-1-2-14-unauthenticated-sql-injection-vulnerability"]}],"documents":[{"id":93506,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slicewp/affiliate-program-suite-1214-unauthenticated-sql-injection-via-email-parameter","title":"Wordfence: Affiliate Program Suite <= 1.2.14 Unauthenticated SQL Injection via 'email'","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93507,"url":"https://patchstack.com/database/wordpress/plugin/slicewp/vulnerability/wordpress-affiliate-program-suite-slicewp-affiliates-plugin-1-2-14-unauthenticated-sql-injection-vulnerability","title":"Patchstack: SliceWP <= 1.2.14 SQL Injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}