Aller au contenu
Se connecter
9.8 Critique

CVE-2023-5877 The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's…

Description

The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
affiliate-toolkit 3.4 premières → < 3.4.3 3.4.3

Autres CVE de affiliate-toolkit

Les 3 CVE de affiliate-toolkit →
CVE-2026-110179 The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist… 6.8 Moyenne CVE-2026-86787 The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template… 7.2 Élevée
Suivre cette CVE