---
id: "CVE-2026-111255"
kind: "vulnerability"
aliases: ["CVE-2026-111255"]
title: "WordPress affiliate-toolkit plugin: file upload lets contributors run code"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugins"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-10-28T04:17:56+00:00"
first_seen_at: "2026-10-28T04:30:58+00:00"
updated_at: "2026-10-28T04:32:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111255", "first_seen_at": "2026-10-28T04:30:58+00:00"}]
---

# WordPress affiliate-toolkit plugin: file upload lets contributors run code

The affiliate-toolkit WordPress plugin up to and including 3.9.2 fails to validate uploaded image types in its upload_image function. An authenticated contributor can upload an executable file and reach remote code execution when the 'import product image' setting is enabled.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin plugin list; versions up to and including `3.9.2` are affected.
- Check whether the 'import product image' option is enabled in the plugin settings.
- unknown for any other check.

## Fix

- Update the affiliate-toolkit plugin to a version later than `3.9.2`; the sources do not name the fixed version.
- Disable the 'import product image' option until the update is applied.
- Review contributor accounts and uploaded files in the media library for unexpected executable files.

## Timeline

- 2026-10-28T04:30:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111255

## From the sources

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload_image function. This is due to insufficient file type validation in upload_image due to a weak Content-Type prefix check and extension derivation from the attacker-controlled URL path, with no dangerous-extension stripping. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the "import product image" option to be enabled in the plugin settings, as this activates the image download pipeline triggered on product post save.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_