Affiliate Toolkit 3.8.7 - 3.9.0 - Contributor+ RCE via BladeOne @php Directive

Description

The plugin does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.
The template sanitizer removes only raw PHP tags and does not neutralise the templating engine's own inline-code directives, so a controlled template body reaches code execution.