---
id: CVE-2026-110179
title: affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter
summary: >-
  The affiliate-toolkit  WordPress plugin before 3.8.9 does not validate a
  user-supplied sort value against an allowlist before using it in a database
  query, and the affected administrative list screen requires only a
  lower-privilege capab…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-89
product: affiliate-toolkit
affected:
  - affiliate-toolkit < 3.8.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T14:36:41.182959Z'
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T14:49:19.976Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110179'
references:
  - url: 'https://wpscan.com/vulnerability/fed6e817-c046-4749-b594-4ff12240f666/'
tags:
  - cve.org
epss: 0.00168
epssPercentile: 0.05613
ingestedAt: '2026-10-16T07:01:11.486Z'
---

## Overview

The affiliate-toolkit  WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.

## Affected

- `affiliate-toolkit < 3.8.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.