CVE-2026-110179 Details

A SQL injection vulnerability has been identified in the Affiliate Toolkit WordPress plugin, affecting versions prior to 3.8.9. The vulnerability arises because the plugin does not properly validate user-supplied sort values against an allowlist before incorporating them into database queries. This issue is compounded by the fact that the affected administrative list screen requires only a lower-privilege capability, allowing users with editor-level access and above to exploit the vulnerability and access arbitrary database information. In multisite environments, a sub-site editor can retrieve data from the network-global users table, including the super administrator's password hash.