Is CVE-2026-12743 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12743 being exploited in the wild.

How severe is CVE-2026-12743?

Medium severity, with a CVSS score of 4.9, published 14 August 2026.

Is there a fix for CVE-2026-12743?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12743 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-12743?

Check whether you run Affiliate-Toolkit Affiliate Toolkit – Multi-Network Affiliate & Amazon Product Display at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12743: Affiliate Toolkit time-based SQL injection in orderby parameter

CVE-2026-12743 · Severity: medium · CVSS 4.9 · Published 2026-08-14

The Affiliate Toolkit WordPress plugin, used to display affiliate products and manage advertising networks, contains a SQL injection vulnerability in its template management functionality. An authenticated administrator can inject arbitrary SQL commands through the orderby parameter to extract sensitive data from the website's database, potentially exposing customer information, financial records, or internal credentials.

Technologies: Affiliate-Toolkit Affiliate Toolkit – Multi-Network Affiliate & Amazon Product Display. Vendors: Affiliate-Toolkit.

Quick answers

Is CVE-2026-12743 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12743 being exploited in the wild.
How severe is CVE-2026-12743?: Medium severity, with a CVSS score of 4.9, published 14 August 2026.
Which products and versions are affected?: Affiliate-Toolkit Affiliate Toolkit – Multi-Network Affiliate & Amazon Product Display up to and including 3.8.8.
Is there a fix for CVE-2026-12743?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12743 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-12743?: Check whether you run Affiliate-Toolkit Affiliate Toolkit – Multi-Network Affiliate & Amazon Product Display at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a time-based SQL injection in the 'orderby' parameter affecting versions up to 3.8.8. The vulnerable code in atkp_template.php and atkp_template_table.php fails to properly escape user-supplied input before incorporating it into SQL queries. The attack requires administrator-level authentication and network access to the WordPress admin interface. Successful exploitation allows attackers to execute arbitrary SQL queries and extract sensitive database contents through time-based inference techniques. A patch is expected from the plugin developers.

Affected products

Affiliate Toolkit Affiliate Toolkit – Multi-Network Affiliate & Amazon Product Display up to and including 3.8.8

Timeline

2026-08-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.