Affiliate Toolkit CVE-2026-86787

Requires an authenticated WordPress account with the Contributor role or above on a site running affiliate-toolkit version 3.8.7 through below 3.9.1; the attacker supplies a template body that the plugin's bundled templating engine compiles and executes as PHP (CWE-94). Exploitation is therefore limited by the need for valid Contributor-level (or higher) credentials - most impactful on multi-author sites or sites permitting self-registration of authors - and by the plugin being installed and within the vulnerable version range. No end-user interaction is needed (UI:N) and the attack is over the network (AV:N), but it is NOT exploitable by fully unauthenticated attackers.

This is a moderate-but-real priority for any site actually running the affiliate-toolkit plugin. CWE-94 code injection yielding arbitrary PHP execution gives total technical impact (C:H/I:H/A:H, SSVC Technical Impact: total), and publicly available exploit code (WPScan) lowers the barrier to opportunistic abuse. However, several signals temper the urgency: EPSS is only 0.18% (8th percentile), SSVC Exploitation is 'none' and Automatable is 'no', and the flaw is NOT in CISA KEV - consistent with a gated, authenticated weakness rather than mass internet-wide exploitation. The most important conflict to flag: the input CVSS vector specifies PR:H (high privileges), yet the description explicitly describes a 'low-privileged user' with the Contributor role - Contributor is a LOW privilege level in WordPress, so PR:L is more defensible and would raise the real severity (my independent reassessment scores 8.8 vs the input 7.2). Net: not a drop-everything internet emergency, but a genuine authenticated RCE that should be patched promptly wherever the plugin is installed, especially on multi-author sites that grant Contributor accounts or allow self-registration.

An attacker who holds (or registers for) a Contributor-level account on a WordPress site running affiliate-toolkit below 3.9.1 submits a crafted template body containing PHP; the plugin's bundled templating engine compiles and executes it server-side, giving the attacker arbitrary PHP code execution. Public exploit code exists (WPScan), so the technique is documented and reproducible. Exploitation is remote over the network but requires valid authenticated credentials, so it is most realistic on sites with multiple authors or open author registration.