CVE-2026-110179: CWE-89 SQL Injection in affiliate-toolkit

CVE-2026-110179 describes an SQL injection vulnerability in the affiliate-toolkit WordPress plugin versions prior to 3.8.9. The plugin fails to validate a user-supplied sort parameter against an allowlist before incorporating it into a database query. The affected administrative list screen requires only editor-level capability, not full administrator rights, enabling users with editor privileges or above to exploit this flaw. In multisite environments, this vulnerability allows sub-site editors to read the network-global users table, exposing sensitive credentials such as the super administrator's password hash.

Users with editor-level access or higher can exploit this vulnerability to perform SQL injection attacks, potentially reading arbitrary information from the database. On multisite WordPress installations, sub-site editors can access the network-global users table, including the super administrator's password hash, which could lead to privilege escalation or further compromise of the network.

Upgrade the affiliate-toolkit WordPress plugin to version 3.8.9 or later, where this vulnerability is fixed. Since no patch links are provided in the input, verify the availability of the official fix from the plugin vendor or WordPress plugin repository before upgrading. Until patched, restrict editor-level access to trusted users only.