affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display <= 3.9.1 - Unauthenticated Server-Side Request Forgery via Image Proxy
- ID
- WPSEC-2026-0896
- Plugin
- affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display (affiliate-toolkit-starter)
- Affected
- all versions before 3.9.2
- Remediation
- Update to 3.9.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-918
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-14
- Attack surface
- affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display on WPSec AttackSurface
- Fix released
- Published
Description
The affiliate-toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery via the image proxy in all versions up to, and including, 3.9.1. This is due to a weak signing key for proxy addresses. The key was a short letter and number pattern stored in a .php file under wp-content/uploads, and when that file could not be written it fell back to an MD5 value derived from the plugin path. Signed addresses were also fetched without any scheme or internal-address validation. This makes it possible for unauthenticated attackers who obtain or derive the key to make web requests to arbitrary locations from the web application, including internal services, and read the responses.
References
- https://wpsec.com/vuln/WPSEC-2026-0896/
- https://plugins.svn.wordpress.org/affiliate-toolkit-starter/tags/3.9.2/
- https://wordpress.org/plugins/affiliate-toolkit-starter/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS