CVE-2026-6169CWE-94

affiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Execution

High · published May 27, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
64.6
In the wild
Unconfirmed
What it is

The affiliate-toolkit plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 3.8.5. This is due to the plugin using the BladeOne templating engine's runString() method which compiles user-supplied template content into PHP code and executes it via eval() without sanitization or sandboxing. This makes it possible for authenticated attackers, with Editor-level access and above, to execute arbitrary code on the server by injecting PHP into a plugin template.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01072 · 64.6th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-05-27T06:46Z
EPSS history
Timeline
  • 27 MAY 06:46Z
    affiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Execution
    cvelistv5