Live › vulnerability › CVE-2026-111255
Go to dashboardThe affiliate-toolkit WordPress plugin up to and including 3.9.2 fails to validate uploaded image types in its upload_image function. An authenticated contributor can upload an executable file and reach remote code execution when the 'import product image' setting is enabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 04:30 UTC. All times on this page are UTC.
Sites running the affiliate-toolkit WordPress plugin version 3.9.2 or earlier with the 'import product image' option enabled. Contributor accounts or higher are needed to exploit it, so sites with no untrusted contributors have lower exposure. Sites without the plugin or with the option disabled can skip it.
No product ranges from the sources yet.
3.9.2 are affected.3.9.2; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload_image function. This is due to insufficient file type validation in upload_image due to a weak Content-Type prefix check and extension derivation from the attacker-controlled URL path, with no dangerous-extension stripping. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the "import product image" option to be enabled in the plugin settings, as this activates the image download pipeline triggered on product post save.
This page as .md · .json · in your agent: get_signal("CVE-2026-111255")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.