Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111255— affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter

Quick assessment

Affected
cservit affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件"affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display"在所有 3.9.2 及更早版本中存在任意文件上传漏洞。该漏洞源于 函数中文件类型验证不足：其 Content-Type 前缀检查强度不足，且文件扩展名是从攻击者可控制的 URL 路径推导得出，同时未对危险扩展名进行过滤。这使得拥有“贡献者”（Contributor）及以上权限的已认证攻击者能够上传可能可执行的文件，从而实现远程代码执行。利用该漏洞需要插件

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111255

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload_image function. This is due to insufficient file type validation in upload_image due to a weak Content-Type prefix check and extension derivation from the attacker-controlled URL path, with no dangerous-extension stripping. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the "import product image" option to be enabled in the plugin settings, as this activates the image download pipeline triggered on product post save.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
cservit affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display 0 ~ 3.9.2 -

II. Public POCs for CVE-2026-111255

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111255

请登录查看更多情报信息。

Other References for CVE-2026-111255 (7)

IV. Related Vulnerabilities

Same product: affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
Same vendor: cservit
Same weakness: CWE-434