# affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display <= 3.9.1 - Unauthenticated Sensitive Information Exposure via AJAX Render Endpoint

- **ID:** WPSEC-2026-0897
- **Plugin:** affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display (`affiliate-toolkit-starter`), https://wordpress.org/plugins/affiliate-toolkit-starter/
- **Affected versions:** all versions before 3.9.2
- **Fixed in:** 3.9.2 (Update to 3.9.2 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/affiliate-toolkit-starter
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0897/

## Description

The affiliate-toolkit plugin for WordPress is vulnerable to Sensitive Information Exposure via the atkp_render_template AJAX action in all versions up to, and including, 3.9.1. This is due to the endpoint rendering product and list IDs taken from the request without checking their post type or post status. This makes it possible for unauthenticated attackers to read the titles, prices, offers and affiliate URLs of private, pending or scheduled products and the contents of non-public lists, as long as AJAX loading or the AJAX handler is enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-0897/
- https://plugins.svn.wordpress.org/affiliate-toolkit-starter/tags/3.9.2/
- https://wordpress.org/plugins/affiliate-toolkit-starter/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0897/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.