The affiliate‑toolkit WordPress plugin, versions earlier than 3.8.9, incorporates a user‑supplied orderby value directly into a database query without first validating it against an allowlist. The administrative list screen that contains this parameter is accessible to users with editor or higher capabilities, rather than requiring administrator rights. This design flaw enables an authenticated editor or higher user to inject arbitrary SQL code, read any table in the database, and exfiltrate sensitive information. If the site runs WordPress Multisite, a sub‑site editor can read the network‑wide users table and obtain a super administrator password hash, potentially allowing full site compromise. The vulnerability is a classic SQL Injection problem (CWE‑89).

WordPress sites installed with the affiliate‑toolkit plugin at version 3.8.8 or earlier are affected. The flaw exists in all installations that include the vulnerable plugin code; the plugin’s lack of an allowlist check is present regardless of site configuration. Multisite setups are particularly risky because a sub‑site editor can read the network‑wide users table, including the super administrator’s password hash. All users with editor level or higher capability can potentially exploit the vulnerability.

The EPSS score of < 1 % indicates a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. However, the vulnerability can be exploited by authenticated users with editor or higher rights, so the likelihood depends on the presence of such users on the site. The CVSS score is 6.8, indicating medium severity, but the impact is significant: an attacker can read arbitrary database contents and on multisite networks gain the super administrator’s password hash, enabling a full takeover. The likely attack vector is an authenticated user with editor or higher capability visiting the vulnerable administrative list screen and providing a crafted orderby value to inject SQL. Based on the description, this vector is inferred from the plugin’s use of the unsanitized parameter and the level of access required to view the screen.