Affiliate‑Toolkit for WordPress can execute arbitrary PHP when an authenticated user with Editor or higher privileges edits a template. The BladeOne method runString() compiles the supplied template into PHP and evaluates it with eval() without sanitizing or sandboxing input. An attacker can inject PHP into a template and have it run on the server, enabling full remote code execution, data exfiltration, or further compromise of the WordPress installation.

This flaw exists in all versions of the cservit Affiliate‑Toolkit plugin up to and including 3.8.5, which provides a multi‑network affiliate and Amazon product display framework for WordPress sites. Users running any of these versions are vulnerable; newer releases beyond 3.8.5 are not affected.

The CVSS score of 7.2 indicates a high‑risk vulnerability. Because it requires authenticated access, attackers must gain or exploit user credentials with Editor or higher roles, but the code is executed remotely via the site interface. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so current exploit prevalence is unknown. Nonetheless, the lack of sanitization in a widely used plugin makes exploitation relatively straightforward once an authenticated user can edit templates.