---
id: CVE-2026-111255
title: >-
  affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File
  Upload via 'atkp_product_largeimageurl' Parameter
summary: >-
  The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
  plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up
  to, and including, 3.9.2 via the upload_image function. This is due to
  insufficient f…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-434
vendor: cservit
product: affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
affected:
  - affiliate-toolkit_multi-network_affiliate_amazon_product_display <= 3.9.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-28T14:58:23.798373Z'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:10:48.081Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111255'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/272a8ee4-8689-4935-89c5-e2f502621511?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/basics/ATKPTools.php#L657
  - url: >-
      https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/basics/ATKPTools.php#L710
  - url: >-
      https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/atkp_posttypes_product.php#L3192
  - url: >-
      https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/dataservices/atkp_productservice.php#L775
  - url: >-
      https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/basics/ATKPTools.php#L546
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3759575%40affiliate-toolkit-starter&new=3759575%40affiliate-toolkit-starter
tags:
  - cve.org
epss: 0.00515
epssPercentile: 0.44047
ingestedAt: '2026-10-28T04:03:46.655Z'
---

## Overview

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload_image function. This is due to insufficient file type validation in upload_image due to a weak Content-Type prefix check and extension derivation from the attacker-controlled URL path, with no dangerous-extension stripping. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the "import product image" option to be enabled in the plugin settings, as this activates the image download pipeline triggered on product post save.

## Affected

- `affiliate-toolkit_multi-network_affiliate_amazon_product_display <= 3.9.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.