affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via Product Image Import
- ID
- WPSEC-2026-1502
- Plugin
- affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display (affiliate-toolkit-starter)
- Affected
- all versions before 3.9.3
- Remediation
- Update to 3.9.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-434
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-23
- Attack surface
- affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display on WPSec AttackSurface
- Fix released
- Published
Description
The affiliate-toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the product image import in all versions up to, and including, 3.9.2. The extension of the saved file was taken from the attacker-supplied image URL and kept whenever the remote server answered with an unregistered 'image/' content type, which allowed files such as .php to be written to the uploads directory. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files to the server, which may make remote code execution possible. Exploitation requires the 'import product image' option to be enabled by an administrator.
References
- https://wpsec.com/vuln/WPSEC-2026-1502/
- https://plugins.svn.wordpress.org/affiliate-toolkit-starter/tags/3.9.3/
- https://wordpress.org/plugins/affiliate-toolkit-starter/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS