TI-2023-05412 Aliases CVE-2023-5877 GHSA-3hh9-m6jx-r3jg

affiliate-toolkit < 3.4.3 - Unauthenticated SSRF

HIGH 82CWE-862Published 2024-01-01 · Updated 2025-06-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-862.

Summary

The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00898 59th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix Fixed affiliate-toolkit (Unknown): 3.4.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	affiliate-toolkit	before 3.4.3	3.4.3	Patch available	CNA

affiliate-toolkit VendorUnknown Affected before 3.4.3 Fixed in 3.4.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:servit:affiliate-toolkit::::::wordpress::*	before 3.4.3	Vulnerable	SERVIT Software Solutions

cpe:2.3:a:servit:affiliate-toolkit:*:*:*:*:*:wordpress:*:* Versions before 3.4.3 Vulnerable ·SERVIT Software Solutions

Remediation

Fix · CNA affiliate-toolkit (Unknown) Fixed in 3.4.3

Timeline

2026-10-02 Threatist record created from CVE-2023-5877
2026-10-03 Alias added: GHSA-3hh9-m6jx-r3jg

References

Exploit 1

https://wpscan.com/vulnerability/39ed4934-3d91-4924-8acc-25759fef9e81

TI-2025-28983 WordPress affiliate-toolkit plugin <= 3.7.3 - Cross Site Request Forgery (CSRF) Vulnerability CVSS 3.1HIGH 8.8
TI-2023-24739 WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.4.3 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1HIGH 7.1
TI-2024-01723 affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_create_list CVSS 3.1MEDIUM 6.5
TI-2023-24135 WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.3.9 is vulnerable to Open Redirection CVSS 3.1MEDIUM 6.1
TI-2023-09586 WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.3.3 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 5.9
TI-2024-02135 affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_import_product CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences