{"id":"CVE-2026-111255","kind":"vulnerability","aliases":["CVE-2026-111255"],"related":[],"title":"WordPress affiliate-toolkit plugin: file upload lets contributors run code","description":"The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload_image function. This is due to insufficient file type validation in upload_image due to a weak Content-Type prefix check and extension derivation from the attacker-controlled URL path, with no dangerous-extension stripping. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the \"import product image\" option to be enabled in the plugin settings, as this activates the image download pipeline triggered on product post save.","summary":"The affiliate-toolkit WordPress plugin up to and including 3.9.2 fails to validate uploaded image types in its upload_image function. An authenticated contributor can upload an executable file and reach remote code execution when the 'import product image' setting is enabled.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugin list; versions up to and including `3.9.2` are affected.\n- Check whether the 'import product image' option is enabled in the plugin settings.\n- unknown for any other check.","fix":"- Update the affiliate-toolkit plugin to a version later than `3.9.2`; the sources do not name the fixed version.\n- Disable the 'import product image' option until the update is applied.\n- Review contributor accounts and uploaded files in the media library for unexpected executable files.","status":"open","published_at":"2026-10-28T04:17:56+00:00","first_seen_at":"2026-10-28T04:30:58+00:00","triaged_at":"2026-10-28T04:32:03+00:00","updated_at":"2026-10-28T04:32:03+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T04:32:03Z","model":"claude-haiku-5-5","output":{"fix":"- Update the affiliate-toolkit plugin to a version later than `3.9.2`; the sources do not name the fixed version.\n- Disable the 'import product image' option until the update is applied.\n- Review contributor accounts and uploaded files in the media library for unexpected executable files.","reach":"internet","title":"WordPress affiliate-toolkit plugin: file upload lets contributors run code","impact":"high","summary":"The affiliate-toolkit WordPress plugin up to and including 3.9.2 fails to validate uploaded image types in its upload_image function. An authenticated contributor can upload an executable file and reach remote code execution when the 'import product image' setting is enabled.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker uploads executable file and runs code on the server","analyst_note":"Confirm the fixed plugin version and whether the upload path is exploited in the wild, using the NVD entry and the plugin vendor's changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin plugin list; versions up to and including `3.9.2` are affected.\n- Check whether the 'import product image' option is enabled in the plugin settings.\n- unknown for any other check.","needs_analyst":true,"not_affected_if":["default-config","auth-required"],"who_is_affected":"Sites running the affiliate-toolkit WordPress plugin version 3.9.2 or earlier with the 'import product image' option enabled. Contributor accounts or higher are needed to exploit it, so sites with no untrusted contributors have lower exposure. Sites without the plugin or with the option disabled can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":3462,"output_tokens":636,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111255':14A,17A '-2026':13A,16A '3.9.2':36B,96C 'access':149C 'activ':181C 'affili':3A,28B,71C,76C 'affiliate-toolkit':2A,27B,70C 'amazon':77C 'arbitrari':86C 'attack':128C,144C 'attacker-control':127C 'authent':49B,143C 'check':121C 'code':11A,59B,162C 'content':118C 'content-typ':117C 'contributor':9A,50B,147C 'contributor-level':146C 'control':129C 'cve':12A,15A 'danger':135C 'dangerous-extens':134C 'deriv':124C 'display':79C 'download':184C 'due':104C,113C 'enabl':68B,174C 'execut':54B,60B,158C,163C 'exploit':165C 'extens':123C,136C 'fail':37B 'file':6A,55B,87C,107C,154C 'function':47B,101C 'host':21B 'imag':41B,46B,65B,100C,112C,170C,183C 'import':63B,168C 'includ':35B,95C 'insuffici':106C 'let':8A 'level':148C 'make':139C,160C 'may':156C 'multi':74C 'multi-network':73C 'network':75C 'option':171C 'packag':18B 'path':131C 'pipelin':185C 'plugin':5A,25B,31B,80C,177C 'possibl':141C,164C 'post':189C 'prefix':120C 'product':64B,78C,169C,188C 'reach':57B 'remot':58B,161C 'requir':166C 'run':10A 'save':190C 'self':20B 'self-host':19B 'set':66B,178C 'strip':137C 'toolkit':4A,29B,72C 'trigger':186C 'type':42B,108C,119C 'upload':7A,40B,45B,52B,88C,99C,111C,153C 'url':130C 'valid':39B,109C 'version':91C 'via':97C 'vulner':84C 'weak':116C 'wordpress':1A,22B,24B,30B,82C 'wordpress-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the affiliate-toolkit WordPress plugin version 3.9.2 or earlier with the 'import product image' option enabled. Contributor accounts or higher are needed to exploit it, so sites with no untrusted contributors have lower exposure. Sites without the plugin or with the option disabled can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T04:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111255","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111255","severity":null,"published_at":"2026-10-28T04:17:56+00:00","modified_at":"2026-10-28T04:17:56+00:00","first_seen_at":"2026-10-28T04:30:58+00:00","fetched_at":"2026-10-28T04:30:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}