CVE-2026-86787CWE-94code-injection
CVE-2026-86787
High · published October 14, 2026
What it is
The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.
The record
Technical detail
- CVSS v3.1
- 7.2 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00408 · 34.0th percentile
- Weakness
- CWE-94 · Improper Control of Generation of Code ('Code Injection')
- Published
- 2026-10-14T11:17Z
References (1)
EPSS history
Timeline