# affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display <= 3.9.1 - Unauthenticated Server-Side Request Forgery via Image Proxy

- **ID:** WPSEC-2026-0896
- **Plugin:** affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display (`affiliate-toolkit-starter`), https://wordpress.org/plugins/affiliate-toolkit-starter/
- **Affected versions:** all versions before 3.9.2
- **Fixed in:** 3.9.2 (Update to 3.9.2 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-918
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/affiliate-toolkit-starter
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0896/

## Description

The affiliate-toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery via the image proxy in all versions up to, and including, 3.9.1. This is due to a weak signing key for proxy addresses. The key was a short letter and number pattern stored in a .php file under wp-content/uploads, and when that file could not be written it fell back to an MD5 value derived from the plugin path. Signed addresses were also fetched without any scheme or internal-address validation. This makes it possible for unauthenticated attackers who obtain or derive the key to make web requests to arbitrary locations from the web application, including internal services, and read the responses.

## References

- https://wpsec.com/vuln/WPSEC-2026-0896/
- https://plugins.svn.wordpress.org/affiliate-toolkit-starter/tags/3.9.2/
- https://wordpress.org/plugins/affiliate-toolkit-starter/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0896/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.