CVE-2026-6169

The affiliate-toolkit plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 3.8.5. This is due to the plugin using the BladeOne templating engine's runString() method which compiles user-supplied template content into PHP code and executes it via eval() without sanitization or sandboxing. This makes it possible for authenticated attackers, with Editor-level access and above, to execute arbitrary code on the server by injecting PHP into a plugin template.

• CWE-94

• https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.8.5/includes/atkp_posttypes_template.php#L735
• https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.8.5/includes/helper/atkp_template_helper.php#L1074
• https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.8.5/lib/bladeone/BladeOne.php#L320
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b6310a0c-5a96-4dbc-940e-025c9b907c7d?source=cve

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61646FastGPT is a knowledge-based AI application platform. Prior …6.3
• CVE-2026-6165A weakness has been identified in code-projects Vehicle Show…7.3
• CVE-2026-6166A security vulnerability has been detected in code-projects …7.3
• CVE-2026-6167A vulnerability was detected in code-projects Faculty Manage…7.3
• CVE-2026-6168A flaw has been found in TOTOLINK A7000R up to 9.1.0u.6115. …8.8
• CVE-2026-61684FastGPT is a knowledge-based AI application platform. In 4.1…8.8
• CVE-2026-61692Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-61710Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-61718bunkerweb is an Open-source and next-generation Web Applicat…5.4
• CVE-2026-61736LightRAG provides simple and fast retrieval-augmented genera…9.3
• CVE-2026-6174The CC Child Pages plugin for WordPress is vulnerable to Sto…6.4
• CVE-2026-61740LightRAG provides simple and fast retrieval-augmented genera…9.3