affiliate-toolkit WordPress plugin: Arbitrary file upload (CVE-2026-111255)
The affiliate-toolkit WordPress plugin contains an arbitrary file upload vulnerability in the upload_image function, allowing authenticated attackers with contributor-level access or higher to achieve remote code execution.
CVE search metadata
CVE search record: CVE-2026-111255. Severity: high. CVSS: 7.5. EPSS: 0.52%. KEV: no. Product: affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress (<= 3.9.2). Brief: affiliate-toolkit WordPress plugin: Arbitrary file upload (CVE-2026-111255). Brief link: https://feed.craftedsignal.io/briefs/2026-10-affiliate-toolkit-rce/
Triage facts
Revision 1- Applicability
- affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress (<= 3.9.2)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 20:14 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The affiliate-toolkit - Multi-Network Affiliate & Amazon Product Display plugin for WordPress (versions up to and including 3.9.2) is vulnerable to arbitrary file upload via the upload_image function. The vulnerability is caused by insufficient file type validation, specifically a weak Content-Type prefix check and extension derivation from an attacker-controlled URL path without stripping dangerous extensions. Exploitation allows authenticated users with contributor-level access or higher to upload executable files, potentially leading to remote code execution. Successful exploitation requires the "import product image" option to be enabled.