Executive brief
The Affiliate Toolkit WordPress plugin, used to display affiliate products and manage advertising networks, contains a SQL injection vulnerability in its template management functionality. An authenticated administrator can inject arbitrary SQL commands through the orderby parameter to extract sensitive data from the website's database, potentially exposing customer information, financial records, or internal credentials.
Technical details
The vulnerability is a time-based SQL injection in the 'orderby' parameter affecting versions up to 3.8.8. The vulnerable code in atkp_template.php and atkp_template_table.php fails to properly escape user-supplied input before incorporating it into SQL queries. The attack requires administrator-level authentication and network access to the WordPress admin interface. Successful exploitation allows attackers to execute arbitrary SQL queries and extract sensitive database contents through time-based inference techniques. A patch is expected from the plugin developers.
Affected products
- Affiliate Toolkit Affiliate Toolkit – Multi-Network Affiliate & Amazon Product Display up to and including 3.8.8
Timeline
- 2026-08-14: disclosed