{
 "id": "WPSEC-2026-0896",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0896/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0896/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0896/index.md",
 "title": "affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display <= 3.9.1 - Unauthenticated Server-Side Request Forgery via Image Proxy",
 "description": "The affiliate-toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery via the image proxy in all versions up to, and including, 3.9.1. This is due to a weak signing key for proxy addresses. The key was a short letter and number pattern stored in a .php file under wp-content/uploads, and when that file could not be written it fell back to an MD5 value derived from the plugin path. Signed addresses were also fetched without any scheme or internal-address validation. This makes it possible for unauthenticated attackers who obtain or derive the key to make web requests to arbitrary locations from the web application, including internal services, and read the responses.",
 "plugin": {
  "slug": "affiliate-toolkit-starter",
  "name": "affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display",
  "full_name": "affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display",
  "wordpress_org": "https://wordpress.org/plugins/affiliate-toolkit-starter/",
  "advisories_url": "https://wpsec.com/vuln/plugin/affiliate-toolkit-starter/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/affiliate-toolkit-starter"
 },
 "type": "SSRF",
 "cwe": [
  "CWE-918"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.9.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.9.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.9.2",
 "remediation": "Update to 3.9.2 or later.",
 "fix_released": "2026-10-13T11:54:28+00:00",
 "published": "2026-10-14T12:52:26+00:00",
 "updated": "2026-10-14T12:18:24.166920+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0896/",
  "https://plugins.svn.wordpress.org/affiliate-toolkit-starter/tags/3.9.2/",
  "https://wordpress.org/plugins/affiliate-toolkit-starter/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/affiliate-toolkit-starter",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-14"
 }
}