---
id: "CVE-2026-120043"
page: "https://infrastack.ai/live/CVE-2026-120043"
kind: "vulnerability"
aliases: ["CVE-2026-120043"]
title: "SliceWP Affiliates WordPress plugin: unauthenticated SQL injection via email parameter"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "slicewp", "fixed": ["1.2.15"], "affected": "<= 1.2.14", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["patched-1.2.15", "plugin-not-installed", "woocommerce-registration-disabled"]
published_at: "2026-11-07T05:18:08+00:00"
first_seen_at: "2026-11-07T05:45:57+00:00"
updated_at: "2026-11-07T06:27:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120043", "first_seen_at": "2026-11-07T05:45:57+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slicewp/affiliate-program-suite-1214-unauthenticated-sql-injection-via-email-parameter", "first_seen_at": "2026-11-07T06:27:03+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slicewp/affiliate-program-suite-1214-unauthenticated-sql-injection-via-email-parameter", "https://patchstack.com/database/wordpress/plugin/slicewp/vulnerability/wordpress-affiliate-program-suite-slicewp-affiliates-plugin-1-2-14-unauthenticated-sql-injection-vulnerability"]}]
exploit_sources: []
---

# SliceWP Affiliates WordPress plugin: unauthenticated SQL injection via email parameter

Link for people: https://infrastack.ai/live/CVE-2026-120043 (this .md is for agents)

The SliceWP Affiliates plugin for WordPress passes the 'email' parameter into an SQL query without proper escaping or preparation, in all versions up to and including 1.2.14. An unauthenticated attacker can append their own SQL queries to existing ones to read sensitive data from the site's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:slicewp affected <= 1.2.14 fixed 1.2.15

## How to check

- WordPress admin > Plugins: if 'Affiliate Program Suite — SliceWP Affiliates' is 1.2.14 or lower, you are on a vulnerable version; 1.2.15 is the patched one.
- Also check whether WooCommerce My Account registration (customer self-registration) is enabled; the injection fires from the user_register hook on a WooCommerce registration, which needs only a guest-obtainable nonce. Sites without WooCommerce or with registration disabled are less exposed, though update anyway.
- After updating, look for unfamiliar admin accounts and odd strings in recent users' email fields.

## Fix

Update SliceWP Affiliates (slug slicewp) to 1.2.15 or newer.

## Timeline

- 2026-11-07T05:45:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120043
- 2026-11-07T06:27:03+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slicewp/affiliate-program-suite-1214-unauthenticated-sql-injection-via-email-parameter — Fixed version 1.2.15 per Wordfence (CVE CNA, researcher Kuba) and Patchstack; WooCommerce registration precondition confirmed on Wordfence. Vendor's own changelog not read (wordpress.org page didn't show it), so nothing marked verified. Patchstack page claims KEV/known exploited, with no corroboration, so exploited left false. No PoC found; no X search done.

## Documents

- [advisory] Wordfence: Affiliate Program Suite <= 1.2.14 Unauthenticated SQL Injection via 'email' https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slicewp/affiliate-program-suite-1214-unauthenticated-sql-injection-via-email-parameter
- [fix] Patchstack: SliceWP <= 1.2.14 SQL Injection https://patchstack.com/database/wordpress/plugin/slicewp/vulnerability/wordpress-affiliate-program-suite-slicewp-affiliates-plugin-1-2-14-unauthenticated-sql-injection-vulnerability

## From the sources

The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.2.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is reachable without any account because the vulnerable code path is triggered via the user_register hook fired on every successful WooCommerce My Account registration, which requires only a guest-obtainable nonce.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_