https://feed.craftedsignal.io/products/affiliate-toolkit--multi-network-affiliate--amazon-product-display-plugin-for-wordpress--3.9.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 20:14:45 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-affiliate-toolkit-rce/Thu, 29 Oct 2026 20:14:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-affiliate-toolkit-rce/The affiliate-toolkit WordPress plugin contains an arbitrary file upload vulnerability in the upload_image function, allowing authenticated attackers with contributor-level access or higher to achieve remote code execution.The affiliate-toolkit - Multi-Network Affiliate & Amazon Product Display plugin for WordPress (versions up to and including 3.9.2) is vulnerable to arbitrary file upload via the upload_image function. The vulnerability is caused by insufficient file type validation, specifically a weak Content-Type prefix check and extension derivation from an attacker-controlled URL path without stripping dangerous extensions. Exploitation allows authenticated users with contributor-level access or higher to upload executable files, potentially leading to remote code execution. Successful exploitation requires the "import product image" option to be enabled.

]]>highadvisory