Unrated
Affiliate Toolkit 3.8.7 - 3.9.0 - Contributor+ RCE via BladeOne @php Directive
The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.
Announced Group revision 1
Original source ↗CVE-2026-86787
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-86787
affiliate-toolkit
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Unknown",
"product": "affiliate-toolkit",
"versions": [
{
"status": "affected",
"version": "3.8.7",
"lessThan": "3.9.1",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-86787
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #21909 · Revision 1
- Added to Heist Feed
- Publisher date