Vulnerabilities / affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display / WPSEC-2026-0897
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display <= 3.9.1 - Unauthenticated Sensitive Information Exposure via AJAX Render Endpoint
Low 3.7
CWE-639Fixed in 3.9.2
- ID
- WPSEC-2026-0897
- Plugin
- affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display (affiliate-toolkit-starter)
- Affected
- all versions before 3.9.2
- Remediation
- Update to 3.9.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-14
- Attack surface
- affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display on WPSec AttackSurface
- Fix released
- Published
Description
The affiliate-toolkit plugin for WordPress is vulnerable to Sensitive Information Exposure via the atkp_render_template AJAX action in all versions up to, and including, 3.9.1. This is due to the endpoint rendering product and list IDs taken from the request without checking their post type or post status. This makes it possible for unauthenticated attackers to read the titles, prices, offers and affiliate URLs of private, pending or scheduled products and the contents of non-public lists, as long as AJAX loading or the AJAX handler is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0897/
- https://plugins.svn.wordpress.org/affiliate-toolkit-starter/tags/3.9.2/
- https://wordpress.org/plugins/affiliate-toolkit-starter/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS