CVE-2026-86787

The affiliate-toolkit plugin for WordPress is vulnerable to Arbitrary File Upload via the upload_image function. Due to insufficient file type validation (weak Content-Type prefix check and extension derivation from attacker-controlled URL path), an authenticated attacker with Contributor-level access or higher can upload executable files, enabling remote code execution. Exploitation requires the 'import product image' option to be enabled.

The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.

The affiliate-toolkit plugin for WordPress, up to and including version 3.8.8, is vulnerable to time-based SQL Injection via the 'orderby' parameter. The vulnerability is due to insufficient escaping of the user-supplied parameter and lack of sufficient preparation of the existing SQL query. This allows authenticated attackers with administrator-level access and above to append additional SQL queries to existing ones, which can be used to extract sensitive information from the database.