{
 "id": "WPSEC-2026-0897",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0897/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0897/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0897/index.md",
 "title": "affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display <= 3.9.1 - Unauthenticated Sensitive Information Exposure via AJAX Render Endpoint",
 "description": "The affiliate-toolkit plugin for WordPress is vulnerable to Sensitive Information Exposure via the atkp_render_template AJAX action in all versions up to, and including, 3.9.1. This is due to the endpoint rendering product and list IDs taken from the request without checking their post type or post status. This makes it possible for unauthenticated attackers to read the titles, prices, offers and affiliate URLs of private, pending or scheduled products and the contents of non-public lists, as long as AJAX loading or the AJAX handler is enabled.",
 "plugin": {
  "slug": "affiliate-toolkit-starter",
  "name": "affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display",
  "full_name": "affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display",
  "wordpress_org": "https://wordpress.org/plugins/affiliate-toolkit-starter/",
  "advisories_url": "https://wpsec.com/vuln/plugin/affiliate-toolkit-starter/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/affiliate-toolkit-starter"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.9.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.9.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.9.2",
 "remediation": "Update to 3.9.2 or later.",
 "fix_released": "2026-10-13T11:54:28+00:00",
 "published": "2026-10-14T12:52:26+00:00",
 "updated": "2026-10-14T12:18:24.166920+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0897/",
  "https://plugins.svn.wordpress.org/affiliate-toolkit-starter/tags/3.9.2/",
  "https://wordpress.org/plugins/affiliate-toolkit-starter/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/affiliate-toolkit-starter",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-14"
 }
}