CVE-2026-86787: Unknown Affiliate-Toolkit

High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days.

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.

Affected products

• Unknown Affiliate-Toolkit: from 3.8.7, before 3.9.1 (fixed in 3.9.1)

Published 2026-10-14. Last modified 2026-10-14.