CVE-2026-110179: affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter

Q: Which users can exploit this issue?

Users with editor-level access or higher can exploit the vulnerable administrative list screen. Administrator access is not required.

Q: What information could an attacker obtain?

An attacker can use SQL injection to read arbitrary information from the database. On WordPress multisite, a sub-site editor can read the network-global users table, including the super administrator's password hash.

Q: Are lower-privilege accounts a meaningful exposure?

Yes. Any account with editor-level or greater access should be considered capable of exploiting the issue, so compromised editor accounts present a database disclosure risk.

Published Oct 16, 2026

Updated

The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.

Affected Software

1 affected component

affiliate-toolkit<3.8.9

Event History

Oct 16, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

Users with editor-level access or higher can exploit the vulnerable administrative list screen. Administrator access is not required.

What information could an attacker obtain?

An attacker can use SQL injection to read arbitrary information from the database. On WordPress multisite, a sub-site editor can read the network-global users table, including the super administrator's password hash.

Are lower-privilege accounts a meaningful exposure?

Yes. Any account with editor-level or greater access should be considered capable of exploiting the issue, so compromised editor accounts present a database disclosure risk.

CVE-2026-110179: affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter

Affected Software

Event History

Frequently Asked Questions

Which users can exploit this issue?

What information could an attacker obtain?

Are lower-privilege accounts a meaningful exposure?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What information could an attacker obtain?

Are lower-privilege accounts a meaningful exposure?