CVE-2026-111255: affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the uploadimage function. This is due to insufficient file type validation in uploadimage due to a weak Content-Type prefix check and extension derivation from the attacker-controlled URL path, with no dangerous-extension stripping. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the "import product image" option to be enabled in the plugin settings, as this activates the image download pipeline triggered on product post save.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the "import product image" option in the plugin settings to deactivate the image download pipeline triggered on product post save.
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress import product image = disabled
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated to WordPress with contributor-level access or higher. No user interaction is required once that access is obtained.
Is the default plugin configuration affected?
Exploitation depends on the plugin's "import product image" option being enabled. That setting activates the image-download path when a product post is saved; the provided data does not state whether it is enabled by default.
What does an attacker need to control?
The attacker needs to provide a URL through the atkp_product_largeimageurl parameter during the product image import flow. The vulnerable upload logic relies on a weak Content-Type prefix check and derives the file extension from the attacker-controlled URL path.
What is the likely impact if exploitation succeeds?
The issue can allow upload of files that may be executable. This can lead to remote code execution with high confidentiality, integrity, and availability impact.