Skip to content
Threat Feed

Tag

Affiliate-Toolkit

1 brief RSS
high advisory

affiliate-toolkit WordPress Plugin RCE via BladeOne Template Injection (CVE-2026-6169)

The affiliate-toolkit plugin for WordPress is vulnerable to remote code execution (CVE-2026-6169) due to the use of the BladeOne templating engine's runString() method, which allows authenticated attackers with Editor-level access or higher to execute arbitrary PHP code by injecting it into a plugin template.

affiliate-toolkit plugin <= 3.8.5 cve rce wordpress affiliate-toolkit template injection
2r 1t 1c