CVE-2026-110179 in affiliate-toolkit Plugin
Summary
by MITRE • 10/16/2026
The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The affiliate-toolkit WordPress plugin version 3.8.9 and earlier contains a critical unauthenticated or low-privilege SQL injection vulnerability that stems from improper input validation of user-supplied data within database queries. The core technical flaw lies in the handling of sort parameters on administrative list screens, where the application fails to validate these inputs against an allowlist before incorporating them directly into Structured Query Language statements. This lack of sanitization allows attackers to inject malicious SQL code that alters the logic of the original query, potentially leading to unauthorized data retrieval or manipulation. The vulnerability is particularly severe because it does not require high-level administrative privileges for exploitation; instead, it can be triggered by users with editor-level access and above, which are roles commonly assigned to content managers rather than strict system administrators in many WordPress deployments.
The operational impact of this flaw extends beyond simple data exfiltration on single-site installations. On WordPress multisite configurations, the vulnerability enables a sub-site editor to read from network-global tables that should theoretically be isolated from individual site contexts. Specifically, an attacker with editor privileges can access the global users table across the entire network. This capability allows them to retrieve sensitive information such as usernames and password hashes for all users in the network, including super administrators who possess full control over the WordPress installation. The exposure of these password hashes facilitates offline brute-force attacks or credential stuffing attempts against other services where users may have reused passwords, thereby escalating the risk from a localized plugin issue to a widespread security compromise affecting the entire multisite infrastructure.
From an industry standards perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command and CWE-269 Improvement of Access Control when performing privileged operations. The failure to restrict access based on role-based permissions reflects a deficiency in implementing robust authorization checks before executing sensitive database operations. Furthermore, the exploitation technique maps directly to MITRE ATT&CK techniques related to Database Credential Dumping and potentially Data Exfiltration over an Encrypted Channel if combined with other vectors. These mappings highlight that the issue is not merely a coding error but also a failure in applying defense-in-depth principles regarding both input validation and access control mechanisms within the application logic.
To mitigate this vulnerability, immediate action should be taken to update the affiliate-toolkit plugin to version 3.8.9 or later where these issues have been addressed through proper input sanitization and stricter role-based access controls. Administrators running multisite installations must verify that no editor-level users retain unnecessary privileges if they do not require direct database interaction capabilities, adhering to the principle of least privilege. Additionally, implementing a Web Application Firewall can provide an additional layer of defense by detecting and blocking common SQL injection patterns in HTTP requests targeting WordPress endpoints. Regular security audits focusing on input validation practices across all active plugins are recommended to prevent similar flaws from being introduced or remaining undetected in future updates.