Description
The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | affiliate-toolkit | 3.8.7 – < 3.9.1 | 3.9.1 |
References
- https://wpscan.com/vulnerability/ec9f71ee-fd44-46fc-989e-3b63ac04e8c3/ exploit vdb-entry technical-description