Read the docs
TI-2026-75278 Aliases CVE-2026-110179GHSA-x236-2cg8-2gw8

SQL injection in affiliate-toolkit WordPress plugin via orderby

Priority LOW 30CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-89.

Summary

The affiliate-toolkit WordPress plugin before 3.8.9 uses a user-supplied sort value in a database query without checking it against an allowlist (CWE-89). Users with editor-level access or higher can read arbitrary database content through SQL injection. On multisite, a sub-site editor can read the network-global users table, including the super administrator's password hash. The references include an exploit link.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00285 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed affiliate-toolkit (Unknown): 3.8.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Unknownaffiliate-toolkitbefore 3.8.93.8.9Patch availableCNA
  • affiliate-toolkit VendorUnknown Affected before 3.8.9 Fixed in 3.8.9 Patch available CNA

Remediation

Update affiliate-toolkit to version 3.8.9 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA affiliate-toolkit (Unknown) Fixed in 3.8.9

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-110179
  2. 2026-10-16 Alias added: GHSA-x236-2cg8-2gw8

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences