UNKNOWN NVD

CVE-2026-86787

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine co

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.

References

https://wpscan.com/vulnerability/ec9f71ee-fd44-46fc-989e-3b63ac04e8c3/

Published: 2026-10-14 · Source: NVD · Feed updated: 2026-10-14

This unknown severity vulnerability was published on 2026-10-14 via NVD.

vulnfeed aggregates 14664 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.