CVE-2026-110179— affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter
Quick assessment
Affected
Unknown affiliate-toolkit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 3.8.9 版本之前的 WordPress 插件 affiliate-toolkit 中，未对用户提供的排序参数进行白名单验证，便直接将其用于数据库查询；同时，受影响的管理列表页面仅要求较低权限（而非管理员权限），因此拥有编辑者（editor）及以上权限的用户可执行 SQL 注入攻击，并读取数据库中的任意信息。在多站点（Multisite）环境中，子站点的编辑者甚至能够读取网络全局的用户表，其中包括超级管理员（super administrator）的密码哈希值。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | affiliate-toolkit | < 3.8.9 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110179
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | affiliate-toolkit | 0 ~ 3.8.9 | - |
|
II. Public POCs for CVE-2026-110179
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110179
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-16 · 18 CVEs total
| CVE-2026-110029 | 5.4 MEDIUM | Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment |
| CVE-2026-109930 | 5.3 MEDIUM | MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key |
| CVE-2026-91833 | WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter | |
| CVE-2026-91830 | Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via | |
| CVE-2026-92427 | Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhoo | |
| CVE-2026-74923 | Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_genera | |
| CVE-2026-110012 | Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upco | |
| CVE-2026-110013 | Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Acc | |
| CVE-2026-109982 | MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via | |
| CVE-2026-105973 | Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Autho | |
| CVE-2026-105974 | Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget | |
| CVE-2026-103696 | Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' Parameter | |
| CVE-2026-110039 | Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite | |
| CVE-2026-110135 | OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute | |
| CVE-2026-110014 | Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer | |
| CVE-2026-110015 | Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF | |
| CVE-2026-110191 | Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disc |
IV. Related Vulnerabilities
Same product: affiliate-toolkit
-
CVE-2026-86787
Affiliate Toolkit 3.8.7 - 3.9.0 - Contributor+ RCE via Blade -
CVE-2026-42721
WordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection -
CVE-2025-46231
WordPress affiliate-toolkit plugin <= 3.7.3 - Cross Site Req -
CVE-2024-37205
WordPress affiliate-toolkit plugin <= 3.4.4 - Sensitive Data -
CVE-2024-29817
WordPress affiliate-toolkit – WordPress Affiliate Plugin plu
Same vendor: Unknown
-
CVE-2026-110029
Squeeze < 1.8.1 - Subscriber+ Missing Authorization via sque -
CVE-2026-109930
MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure v -
CVE-2026-110191
Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contr -
CVE-2026-110015
Salon Booking System < 10.31.9 - Administrator Account Creat -
CVE-2026-110014
Salon Booking System < 10.31.9 - Unauthenticated Booking Cre
V. Comments for CVE-2026-110179
No comments yet