What the vulnerability does
01Description
The affiliate-toolkit plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 3.8.5. This is due to the plugin using the BladeOne templating engine's runString() method which compiles user-supplied template content into PHP code and executes it via eval() without sanitization or sandboxing. This makes it possible for authenticated attackers, with Editor-level access and above, to execute arbitrary code on the server by injecting PHP into a plugin template.
Explanation of Vulnerability in Simple Terms
02Summary
Affiliate Toolkit versions 3.8.4 and earlier contain a code injection vulnerability that allows high-privilege users to execute arbitrary PHP code on the site. An attacker with admin or equivalent access can inject malicious code through the plugin's functionality, leading to full site compromise. This affects all installations of the plugin up to version 3.8.4.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the site with full server privileges.
Potential impact on your site
04Site Impact
A compromised admin account can execute code to steal data, modify content, or take over the entire site.
Conditions required to exploit
05Prerequisites
Attacker must have high-level admin or equivalent privileges on the WordPress site.
Key dates
06Disclosure timeline
May 27, 2026
CVE published
May 27, 2026
Record updated
