A low‑privileged WordPress user with the Contributor role can supply a custom template body to the Affiliate Toolkit plugin, which the bundled BladeOne templating engine compiles and executes as PHP. This code injection flaw (CWE‑94) allows attackers to run arbitrary PHP code on the server, potentially compromising the confidentiality, integrity, and availability of the site.

WordPress installations running Affiliate Toolkit versions 3.8.7 through 3.9.0 are affected. The issue stems from the plugin’s templating engine and is independent of specific WordPress core releases. Current releases of the plugin after version 3.9.1 are not vulnerable.

The CVSS score of 7.2 indicates a high severity, while the EPSS score of less than 1 % shows a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is web‑based; it is inferred that an attacker with Contributor permissions can craft a malicious template through the plugin’s admin interface or an exposed endpoint, resulting in server‑side execution of PHP code. This inference is drawn from the description that a low‑privileged user can supply a template body, but the exact pathway is not explicitly documented in the data.