Unknown Affiliate Toolkit vulnerabilities

3 vulnerabilities

Known vulnerabilities in Unknown Affiliate Toolkit, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.8CVE-2026-110179unknownaffiliate-toolkit
EPSS score
0.29%
The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.7.2CVE-2026-86787unknownaffiliate-toolkit
EPSS score
0.41%
The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.9.8CVE-2023-5877servitaffiliate-toolkit+2
EPSS score
0.90%
The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.