{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/affiliate-toolkit--multi-network-affiliate--amazon-product-display-plugin-for-wordpress--3.9.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-111255"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["affiliate-toolkit – Multi-Network Affiliate \u0026 Amazon Product Display plugin for WordPress (\u003c= 3.9.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe affiliate-toolkit - Multi-Network Affiliate \u0026amp; Amazon Product Display plugin for WordPress (versions up to and including 3.9.2) is vulnerable to arbitrary file upload via the \u003ccode\u003eupload_image\u003c/code\u003e function. The vulnerability is caused by insufficient file type validation, specifically a weak Content-Type prefix check and extension derivation from an attacker-controlled URL path without stripping dangerous extensions. Exploitation allows authenticated users with contributor-level access or higher to upload executable files, potentially leading to remote code execution. Successful exploitation requires the \u0026quot;import product image\u0026quot; option to be enabled.\u003c/p\u003e\n","date_modified":"2026-10-29T20:14:45Z","date_published":"2026-10-29T20:14:45Z","id":"https://feed.craftedsignal.io/briefs/2026-10-affiliate-toolkit-rce/","summary":"The affiliate-toolkit WordPress plugin contains an arbitrary file upload vulnerability in the upload_image function, allowing authenticated attackers with contributor-level access or higher to achieve remote code execution.","title":"affiliate-toolkit WordPress plugin: Arbitrary file upload (CVE-2026-111255)","url":"https://feed.craftedsignal.io/briefs/2026-10-affiliate-toolkit-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Affiliate-Toolkit – Multi-Network Affiliate \u0026 Amazon Product Display Plugin for WordPress (\u003c= 3.9.2)","version":"https://jsonfeed.org/version/1.1"}