Security notice
Run an affiliate program with SliceWP on WordPress? Someone without a login can try to read your site's database. Update to 1.2.15 or later today.
The SliceWP Affiliates plugin for WordPress has CVE-2026-120043 in versions 1.2.14 and earlier. It is an unauthenticated SQL injection: someone without a login can send crafted input that tries to read information out of your site's database, which can hold customer details and user accounts. Patchstack marks it as known to be exploited. Update to 1.2.15 or later today. If you cannot update, deactivate the plugin until you can. (Patchstack, NVD)
What happened
- The flaw. CVE-2026-120043 affects the SliceWP Affiliates plugin for WordPress through 1.2.14. A weakness in how the plugin handles the email address lets an attacker without a login add their own database commands. NVD says the vulnerable code runs when a visitor registers through a WooCommerce My Account page, so no existing account is needed. (Patchstack, NVD)
- What an attacker gets. Information from the site's database, which can include customer details and user accounts. Patchstack describes this class of flaw as one where attackers can read, modify or delete the entire database. (Patchstack, NVD)
- The fix. Patchstack lists 1.2.15 as the patched version, and WordPress.org currently ships 1.2.15. (Patchstack)
- Severity. Patchstack rates it CVSS 9.3, high priority, requires no login, and marks it as known to be exploited. NVD lists a Wordfence score of 7.5 (high). (Patchstack, NVD)
Who should worry
Any WordPress site running SliceWP 1.2.14 or earlier, especially online stores where visitors can register through WooCommerce.
What to do now
- Update SliceWP to 1.2.15 or later today. Back up the site and database first, then update. (Patchstack)
- If the update has to wait, deactivate the plugin until you can install the fixed version. This pauses your affiliate tracking, so let your affiliates know.
- Check for signs of tampering. Look for unexpected new admin or customer accounts, changed passwords, odd orders or form entries, and strange database activity. Updating closes the flaw; it does not undo access an attacker may already have gained.
- If you find signs of a break-in, change passwords, tell affected customers, and ask your developer or host to investigate.
What to send your developer, agency or host
Please check whether our WordPress site runs the SliceWP Affiliates plugin. CVE-2026-120043 affects SliceWP versions 1.2.14 and earlier; it is an unauthenticated SQL injection that can expose database contents, fixed in 1.2.15. Please update today, or deactivate until the update can be installed, then check for unexpected accounts or database activity and confirm the version you left us on. Sources: Patchstack, NVD.
Common questions
Does this mean my site was hacked?
No. A vulnerable version is a reason to update and review the site, not proof of a break-in. Patchstack marks this flaw as known to be exploited, so do not wait.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We cannot see which WordPress plugins your site runs or which versions they are on. A scan without a warning about this plugin does not mean your site is safe.
Where can I follow updates?
Follow Patchstack, the NVD entry and the plugin page on WordPress.org. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Patchstack: CVE-2026-120043, affected SliceWP versions 1.2.14 and earlier, patched in 1.2.15, CVSS 9.3, published November 6, 2026.
- NVD: CVE-2026-120043 record.
- the plugin page on WordPress.org.