Description

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-14T06:16:40.573Z",
  "pubdate": "2026-08-14T06:16:40.573Z",
  "executiveSummary": "An authenticated time-based SQL Injection vulnerability has been identified in the affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress. The flaw exists due to insufficient escaping of user-supplied input provided to the 'orderby' parameter and a lack of proper query preparation in the existing SQL implementation. This security deficiency allows authenticated attackers with administrator-level access or higher to manipulate database queries by appending malicious SQL statements. Successfully exploiting this vulnerability enables threat actors to extract sensitive information from the underlying database through inferential time-based techniques. The risk implications are severe, as unauthorized data exfiltration compromises the confidentiality and integrity of the entire WordPress database. Exploitation requires authenticated administrative privileges within the application, limiting the attack vector to users who have already achieved high-level access control within the target WordPress instance. Affected software includes all versions up to, and including, 3.8.8.",
  "technicalDetails": "The vulnerability resides in the affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress, specifically affecting all versions up to, and including, 3.8.8. The root cause of the vulnerability is insufficient input sanitization, validation, and escaping applied to the user-supplied 'orderby' parameter, coupled with the absence of sufficient parameterization or preparation on the underlying SQL queries executed by the application.\nThe vulnerable component processes the 'orderby' parameter directly within database query construction. Because the input is unsanitized and unescaped, an authenticated attacker possessing administrator-level privileges or higher can supply a specially crafted payload containing malicious SQL syntax. This input breaks out of the intended query context and allows the attacker to append additional SQL commands to the existing database query structure.\nExploitation occurs via a time-based SQL Injection methodology. Since direct output from the injected query may not be reflected natively in the application response, the attacker leverages conditional time delays—such as SQL functions that pause execution—to infer the truth of boolean conditions and systematically extract sensitive information from the database character by character. The attack flow begins with the attacker crafting an HTTP request containing the malicious payload injected into the 'orderby' parameter. The server processes the request, incorporates the unescaped parameter into the vulnerable SQL query, and executes the resulting statement against the database backend. The database evaluates the injected logic, introducing measurable latency based on the evaluated data. By measuring response times, the attacker confirms the injected hypotheses and completes data exfiltration.\nThe vulnerability requires authenticated access with administrator privileges or higher. The network exposure is dictated by the accessibility of the WordPress administrative interface. Post-exploitation impact includes unauthorized read access to the database, potentially exposing confidential records, user credentials, and other sensitive data stored within the WordPress environment."
}