Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-111255EUVD-2026-111574GHSA-6WVW-5JHH-GCG4

affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter

Published
Last modified
published
Not listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

The affiliate-toolkit WordPress plugin, which provides multi-network affiliate and Amazon product display features, is affected by this flaw. An authenticated user with contributor-level access or higher could upload potentially executable files to the site, which could allow remote code execution on the server.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload_image function. This is due to insufficient file type validation in upload_image due to a weak Content-Type prefix check and extension derivation from the attacker-controlled URL path, with no dangerous-extension stripping. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the "import product image" option to be enabled in the plugin settings, as this activates the image download pipeline triggered on product post save.

Timeline

  1. CVE published
  2. First seen by cve.now
  3. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  4. Record last updated

Affected versions

  • cservit affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display

    through 3.9.2

References 7

wordfence.com

plugins.trac.wordpress.org