Affiliate Toolkit CVE-2026-42721

Requires an authenticated session with high privileges (administrator-level, per PR:H in the CVSS vector) on a WordPress site running the affiliate-toolkit / affiliate-toolkit-starter plugin at version 3.9.1 or earlier; the attacker then supplies malicious input to a plugin parameter that is concatenated into a SQL query. Key limiting factors: the high-privilege authentication requirement excludes anonymous and low-privilege users, and the injection is blind (no direct query output), so data must be extracted via inference. Exploitation is remote over the network with low complexity and no user interaction once that privileged access exists.

This is a moderate-priority issue rather than an emergency. The CVSS 3.1 base score of 7.6 (vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) is driven largely by the Scope:Changed flag and network reachability, but the single most important mitigating signal is PR:H - exploitation requires an already-authenticated high-privilege account (typically administrator-level on the WordPress site), which sharply narrows the realistic attacker population. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the input, so there is no evidence of active exploitation or automation: exploitation status is 'no public exploit identified at time of analysis.' The blind nature of the SQL injection also raises the operational effort required, since data must be inferred boolean/time-wise rather than read directly. One signal worth flagging: Patchstack's assignment of S:C (scope change) and A:L for a blind SQL injection is atypical and inflates the score somewhat - a more conventional assessment would treat this as S:U with confidentiality-only impact. Net: a genuine vulnerability that authenticated-admin threat models should patch, but not a mass-exploitation / drop-everything priority given PR:H and the absence of KEV/POC/EPSS signals.

An attacker who has already obtained a high-privilege (administrator-level) account on a WordPress site running affiliate-toolkit 3.9.1 or earlier submits crafted input to a vulnerable plugin parameter, triggering a blind SQL injection. Because the injection is blind, the attacker uses boolean- or time-based inference to extract sensitive database contents such as user records and credentials. No public exploit code was identified at the time of analysis, and the PR:H requirement means a privileged foothold is a prerequisite.