CVE-2026-86787 Details
Description
The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.
A remote code execution vulnerability has been identified in the Affiliate Toolkit WordPress plugin, affecting versions prior to 3.9.1. The issue arises because the plugin's templating engine allows low-privileged users to submit template bodies that are compiled and executed as PHP. This vulnerability enables users with the Contributor role or higher to execute arbitrary PHP code on the server. The template sanitizer only removes raw PHP tags and fails to neutralize the templating engine's inline-code directives, allowing a controlled template body to reach code execution.
Users are advised to update the Affiliate Toolkit WordPress plugin to version 3.9.1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/ec9f71ee-fd44-46fc-989e-3b63ac04e8c3/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Affiliate Toolkit | >= 3.8.7, <= 3.9.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |