PatchSiren

Affiliate Toolkit CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review Affiliate Toolkit CVE published 2026-10-16

CVE-2026-110179

The affiliate-toolkit WordPress plugin before 3.8.9 is vulnerable to SQL injection, allowing users with editor-level access and above to read arbitrary information from the database. On multisite, a sub-site editor can read the network-global users table, including the super administrator's password hash. This vulnerability has significant implications for WordPress administrators and security teams, who [truncated]