What is the CVSS score of CVE-2026-6169?

CVE-2026-6169 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of affiliate-toolkit are affected by CVE-2026-6169?

The affiliate-toolkit WordPress plugin (versions up to 3.8.5) contains a remote code execution vulnerability allowing authenticated Editor-level users to execute arbitrary server-side code through an…

How to fix or mitigate CVE-2026-6169?

Within 24 hours: Audit all WordPress users with Editor-level or higher privileges on any site running affiliate-toolkit version 3.8.5 or earlier; document business justification for each account. Within 7 days: Either disable the plugin entirely or restrict Editor-level access to trusted administrators only. Within 30 days: Monitor the plugin repository for security updates; if no patch is released within 60 days, plan migration to alternative affiliate display plugins.

affiliate-toolkit CVE-2026-6169

EUVD-2026-32105 HIGH

Code Injection (CWE-94)

2026-05-27 security@wordfence.com

GHSA-h6jg-7g8r-wgqw

Code Injection RCE PHP WordPress

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:44 vuln.today

CVE Published

May 27, 2026 - 08:16 nvd

HIGH 7.2

DescriptionCVE.org

The affiliate-toolkit plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 3.8.5. This is due to the plugin using the BladeOne templating engine's runString() method which compiles user-supplied template content into PHP code and executes it via eval() without sanitization or sandboxing. This makes it possible for authenticated attackers, with Editor-level access and above, to execute arbitrary code on the server by injecting PHP into a plugin template.

AnalysisAI

Remote code execution in the affiliate-toolkit WordPress plugin ("Multi-Network Affiliate & Amazon Product Display") affects versions up to and including 3.8.5, letting authenticated users with Editor-level access or higher run arbitrary PHP on the host. The flaw stems from the bundled BladeOne template engine's runString() method, which compiles attacker-supplied template content into PHP and executes it through eval() with no sanitization or sandboxing. There is no public exploit identified at time of analysis and EPSS sits at a low 0.24%, but the technical impact is total because a successful injection yields full server-side code execution.

Technical ContextAI

The vulnerability lives in the plugin's use of BladeOne, a standalone PHP implementation of Laravel's Blade templating engine. BladeOne's runString() (referenced at lib/bladeone/BladeOne.php line 320) takes raw template text, transpiles it into PHP, and evaluates it via eval(); the plugin feeds user-controlled template content into this path through its post-type template and template-helper code (atkp_posttypes_template.php and atkp_template_helper.php). This is a textbook CWE-94 (Improper Control of Generation of Code / code injection): because template directives are compiled and eval()'d rather than treated as inert data, any PHP an attacker embeds in a plugin template becomes executable. The affected component per ENISA EUVD is "affiliate-toolkit - Multi-Network Affiliate & Amazon Product Display"; no CPE string was supplied in the input.

RemediationAI

No vendor-released patch version is confirmed in the available data, and the version data is conflicting: the description marks 3.8.5 as vulnerable while EUVD implies 3.8.4 and earlier are affected (which would suggest 3.8.5 as a fix) - confirm the fixed release directly with the vendor or the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/b6310a0c-5a96-4dbc-940e-025c9b907c7d?source=cve) before relying on an upgrade. Until a confirmed patched build is identified, apply compensating controls: restrict who holds Editor and Administrator roles and audit existing Editor accounts, since the attack requires that privilege level; disable or remove the affiliate-toolkit plugin if it is not actively needed, accepting loss of affiliate-product display functionality; and put a WAF or virtual-patching rule in front of the plugin's template-editing endpoints to block PHP payloads, accepting that template-rule tuning may cause false positives for legitimate template content. Monitor the WordPress plugin repository for a release later than 3.8.5 and update as soon as a fixed version is published.