Skip to content
Sign in
9.8 Critical

CVE-2023-5877 The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's…

Description

The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.

Affected products and versions

Product Affected versions Fixed in
affiliate-toolkit 3.4 earliest → < 3.4.3 3.4.3

Other CVEs of affiliate-toolkit

The 3 CVEs of affiliate-toolkit →
CVE-2026-110179 The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist… 6.8 Medium CVE-2026-86787 The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template… 7.2 High
Track this CVE