CVE-2026-111255
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
The affiliate-toolkit plugin for WordPress is vulnerable to Arbitrary File Upload via the upload_image function. Due to insufficient file type validation (weak Content-Type prefix check and extension derivation from attacker-controlled URL path), an authenticated attacker with Contributor-level access or higher can upload executable files, enabling remote code execution. Exploitation requires the 'import product image' option to be enabled.
Risk Assessment
Potential remote code execution on the server through a malicious uploaded file, leading to full compromise of the website and infrastructure.
Recommendation
Update the affiliate-toolkit plugin to a version later than 3.9.2, disable the product image import option if not needed, and restrict Contributor-level access.
Other vulnerabilities in affiliate-toolkit WordPress plugin
See all- CVE-2026-110179Medium
The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.
- CVE-2026-86787High
The affiliate-toolkit WordPress plugin before version 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.
- CVE-2026-12743Medium
The affiliate-toolkit plugin for WordPress, up to and including version 3.8.8, is vulnerable to time-based SQL Injection via the 'orderby' parameter. The vulnerability is due to insufficient escaping of the user-supplied parameter and lack of sufficient preparation of the existing SQL query. This allows authenticated attackers with administrator-level access and above to append additional SQL queries to existing ones, which can be used to extract sensitive information from the database.
Original NVD description (English source)
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload_image function. This is due to insufficient file type validation in upload_image due to a weak Content-Type prefix check and extension derivation from the attacker-controlled URL path, with no dangerous-extension stripping. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the "import product image" option to be enabled in the plugin settings, as this activates the image download pipeline triggered on product post save.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS