What is the CVSS score of EUVD-2026-58590?

EUVD-2026-58590 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

affiliate-toolkit WordPress Plugin EUVD-2026-58590

| CVE-2026-12743 MEDIUM

SQL Injection (CWE-89)

2026-08-14 Wordfence

GHSA-4954-43cr-fhmh

WordPress SQLi Wordpress Plugin Affiliate Toolkit Multi Network Affiliate Amazon Product Display

4.9

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

Administrator authentication is mandatory (PR:H); network-delivered but high-privilege gate; no integrity or availability impact from blind read-only SQL injection.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 06:00 vuln.today

CVE Published

Aug 14, 2026 - 05:30 cve.org

MEDIUM 4.9

DescriptionCVE.org

The affiliate-toolkit - Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

Time-based SQL injection in the affiliate-toolkit WordPress plugin (all versions up to and including 3.8.8) enables authenticated administrators to blindly enumerate and extract arbitrary data from the WordPress database by manipulating the unsanitized orderby parameter in template administrative pages. The impact is limited to confidentiality - database modification and denial-of-service are not achievable via this vector. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, consistent with the high authentication barrier (PR:H) that substantially constrains real-world exploitability.

Technical ContextAI

The affected product is the cservit-developed affiliate-toolkit plugin (CPE: cpe:2.3:a:cservit:affiliate-toolkit_-_multi-network_affiliate_&_amazon_product_display:*:*:*:*:*:*:*:*), which provides multi-network affiliate link management and Amazon product display capabilities for WordPress. CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command) is the root cause class: the orderby parameter supplied by the user is appended into existing SQL queries without adequate escaping or use of prepared statements, enabling time-based blind injection. Wordfence has pinpointed two specific vulnerable code paths: includes/models/atkp_template.php at line 147 and includes/pages/atkp_template_table.php at line 279 - both within administrative template listing and sorting functionality. ORDER BY injection is a well-understood attack class where parameterization is often omitted because column names cannot be bound as parameters in most database drivers, requiring explicit allowlisting instead.

RemediationAI

An upstream fix is available via a WordPress plugin repository changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3634918%40affiliate-toolkit-starter&new=3634918%40affiliate-toolkit-starter); however, a specific patched release version number is not independently confirmed from the available intelligence - site owners should verify the current version in the WordPress Plugin Directory and update to any version beyond 3.8.8 once a tagged release is confirmed. As a compensating control prior to patching, restrict access to the WordPress administrative dashboard (/wp-admin/) to trusted IP ranges via server-level ACLs (nginx allow/deny directives or Apache Require ip) - this eliminates the network attack vector entirely since exploitation requires an active admin session. Note that IP restriction affects all admin users and may disrupt remote administration workflows.