WordPress Affiliate Toolkit Plugin Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the affiliate-toolkit plugin for WordPress, affecting all versions up to and including 3.8.5. The issue arises because the plugin utilizes the BladeOne templating engine's runString() method, which compiles user-supplied template content into PHP code and executes it via eval() without proper sanitization or sandboxing. This vulnerability allows authenticated attackers with Editor-level access and above to execute arbitrary code on the server by injecting PHP into a plugin template.

Impact

Exploitation of this vulnerability allows for authenticated users with Editor-level access and above to execute arbitrary code on the server.