Affiliate Toolkit EUVD-2026-102697

Requires an authenticated account with editor-level capability or higher (the vulnerable administrative list screen gates on a lower-privilege capability instead of an administrator capability), plus the affiliate-toolkit plugin installed at a version before 3.8.9. Exploitation is performed by supplying an attacker-controlled 'sort' value that is not validated against an allowlist before use in the SQL query. The impact is amplified on WordPress multisite deployments, where a sub-site editor can read the network-global wp_users table including the super administrator's password hash; on single-site installs the attacker is still bounded by needing a valid editor+ account, which limits purely external, unauthenticated attackers.

This is a genuine but moderate-priority issue, not a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, base 6.8) describes network-reachable, low-complexity SQL injection with high confidentiality impact and a changed scope - the scope change is well-justified because a multisite sub-site editor can reach the network-global users table beyond their own site boundary. EPSS is low (0.17%, 6th percentile) and the vulnerability is NOT in CISA KEV, indicating no evidence of widespread or active exploitation; however, POC/exploit code is publicly available via WPScan, which raises the practical likelihood of opportunistic use against unpatched sites. CONFLICT TO VERIFY: the input CVSS encodes PR:H (administrator-level privilege), yet the description explicitly states that only editor-level capability is required - these disagree, and PR:H appears to understate the real risk; an editor role is a low-privilege authenticated role, so the true privilege barrier is lower than the official vector implies. Net: authenticated-only and low real-world exploitation probability keep this below critical, but the combination of a public exploit, a low privilege barrier in practice, and disclosure of the super-admin password hash on multisite makes patching a clear near-term priority.

An attacker who already holds (or phishes/obtains) an editor-level account on a WordPress site running affiliate-toolkit before 3.8.9 opens the plugin's administrative list screen and supplies a crafted 'sort' parameter that is injected directly into a database query. Public exploit code exists (WPScan), so weaponization is trivial; on a multisite install a mere sub-site editor can read the network-global users table and exfiltrate the super administrator's password hash for offline cracking or privilege escalation.