CVE-2026-12743 describes a time-based SQL Injection vulnerability in the affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress. The flaw exists in the handling of the 'orderby' parameter, which is insufficiently escaped and not properly prepared in SQL queries. Authenticated attackers with administrator privileges can exploit this to append arbitrary SQL commands to existing queries, potentially extracting sensitive database information. The vulnerability affects all versions up to and including 3.8.8. No patch or official remediation has been confirmed as of the published date.

An attacker with administrator-level access can exploit this vulnerability to perform time-based SQL Injection attacks, allowing them to extract sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure via SQL injection. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to SQL queries involving the 'orderby' parameter.