Affiliate Toolkit Multi Network Affiliate Amazon Product Display
Monthly
Time-based SQL injection in the affiliate-toolkit WordPress plugin (all versions up to and including 3.8.8) enables authenticated administrators to blindly enumerate and extract arbitrary data from the WordPress database by manipulating the unsanitized `orderby` parameter in template administrative pages. The impact is limited to confidentiality - database modification and denial-of-service are not achievable via this vector. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, consistent with the high authentication barrier (PR:H) that substantially constrains real-world exploitability.
Time-based SQL injection in the affiliate-toolkit WordPress plugin (all versions up to and including 3.8.8) enables authenticated administrators to blindly enumerate and extract arbitrary data from the WordPress database by manipulating the unsanitized `orderby` parameter in template administrative pages. The impact is limited to confidentiality - database modification and denial-of-service are not achievable via this vector. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, consistent with the high authentication barrier (PR:H) that substantially constrains real-world exploitability.