Read the docs
TI-2026-81670 Aliases CVE-2026-111255GHSA-6wvw-5jhh-gcg4

Arbitrary file upload in affiliate-toolkit WordPress plugin

Priority LOW 35CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

The affiliate-toolkit WordPress plugin by cservit is affected in all versions through 3.9.2. The upload_image function does not validate file types properly and derives the file extension from an attacker-controlled URL, so uploaded files may be executable (CWE-434). An authenticated attacker with Contributor-level access or higher can upload such files and achieve remote code execution, but only when the import product image option is enabled in the plugin settings.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload_image function. This is due to insufficient file type validation in upload_image due to a weak Content-Type prefix check and extension derivation from the attacker-controlled URL path, with no dangerous-extension stripping. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the "import product image" option to be enabled in the plugin settings, as this activates the image download pipeline triggered on product post save.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00515 44th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cservitaffiliate-toolkit – Multi-Network Affiliate & Amazon Product Displayup to 3.9.2—No fix listedCNA
  • affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display Vendorcservit Affected up to 3.9.2 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for affiliate-toolkit (Multi-Network Affiliate & Amazon Product Display).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-111255
  2. 2026-10-28 Alias added: GHSA-6wvw-5jhh-gcg4
  3. 2026-10-28 CISA SSVC decision points changed
  4. 2026-10-28 Priority changed: MEDIUM → LOW

References

Other 7

  • TI-2026-81648 Stored cross-site scripting in affiliate-toolkit WordPress plugin CVSS 3.1HIGH 7.2
  • TI-2026-05412 affiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Execution CVSS 3.1HIGH 7.2
  • TI-2024-06084 affiliate-toolkit <= 3.5.5 - Unauthenticated Full Path Dislcosure CVSS 3.1MEDIUM 5.3
  • TI-2026-12872 affiliate-toolkit – WP Affiliate Plugin with Amazon <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.4
  • TI-2024-09893 affiliate-toolkit <= 3.6.7 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2024-09483 affiliate-toolkit <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product Shortcode CVSS 3.1MEDIUM 6.4
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences