CVE-2026-111255Published
affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-111255 · Microsoft / collected KEV context
cve-program · CVE-2026-111255
- https://www.wordfence.com/threat-intel/vulnerabilities/id/272a8ee4-8689-4935-89c5-e2f502621511?source=cve
- https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/basics/ATKPTools.php#L657
- https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/basics/ATKPTools.php#L710
- https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/atkp_posttypes_product.php#L3192
- https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/dataservices/atkp_productservice.php#L775
- https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/basics/ATKPTools.php#L546
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3759575%40affiliate-toolkit-starter&new=3759575%40affiliate-toolkit-starter
Related operational evidence
Explicit CVE identifiers- affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter · Newly collected advisory · 28 Oct 2026