SliceWP Affiliates: SQL injection in email parameter (CVE-2026-120043)
An unauthenticated SQL injection vulnerability in SliceWP Affiliates versions 1.2.14 and earlier allows remote attackers to extract sensitive database information via the email parameter during WooCommerce registration.
CVE search metadata
CVE search record: CVE-2026-120043. Severity: high. CVSS: 7.5. KEV: no. Product: SliceWP Affiliates (<= 1.2.14). Brief: SliceWP Affiliates: SQL injection in email parameter (CVE-2026-120043). Brief link: https://feed.craftedsignal.io/briefs/2026-11-slicewp-sql-injection/
Triage facts
Revision 1- Applicability
- SliceWP Affiliates (<= 1.2.14)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 7, 05:59 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CVE-2026-120043 is a SQL injection vulnerability within the SliceWP Affiliates plugin for WordPress. The flaw exists in the handling of the 'email' parameter due to insufficient input escaping and lack of parameterized queries. The vulnerability is reachable without authentication via the 'user_register' hook, which is triggered during WooCommerce user account creation. Successful exploitation allows an attacker to append arbitrary SQL queries to the backend database, potentially resulting in unauthorized data access.
Impact
Unauthenticated remote attackers can perform arbitrary SQL queries against the underlying WordPress database, leading to the potential exposure of sensitive application data.
Recommendation
- Upgrade the SliceWP Affiliates plugin to a version released after 1.2.14 that includes the fix for CVE-2026-120043.
- Until patching is possible, monitor WooCommerce registration traffic for anomalous 'email' parameter values containing SQL control characters or keywords.
- Audit database access logs for queries originating from the application layer that deviate from the expected baseline, particularly those involving unexpected UNION or OR statements.
Immediate actions
Upgrade SliceWP Affiliates plugin to the latest patched version
Threat Hunt
Monitor web access logs for suspicious input in WooCommerce registration requests
Data: Web server access logs capturing HTTP POST requests to registration endpoints
Mitigations
Upgrade SliceWP Affiliates to version > 1.2.14
CVE-2026-120043