Description

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.

Related CPE's

Could not find any relations

References

https://wpscan.com/vulnerability/ec9f71ee-fd44-46fc-989e-3b63ac04e8c3/

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0

Secondary
CWE-94

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.2 · High

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-14T07:17:03.643Z

10 hours ago

Last modified

2026-10-14T16:14:02.800Z

1 hour ago