Product
The affiliate-toolkit WordPress plugin contains an arbitrary file upload vulnerability in the upload_image function, allowing authenticated attackers with contributor-level access or higher to achieve remote code execution.