https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 28 Oct 2026 23:55:17 +0000 https://db.gcve.eu/vuln/ghsa-6wvw-5jhh-gcg4 <p>The affiliate-toolkit – Multi-Network Affiliate &amp; Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload_image function. This is due to insufficient file type validation in upload_image due to a weak Content-Type prefix check and extension derivation from the attacker-controlled URL path, with no dangerous-extension stripping. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the &#34;import product image&#34; option to be enabled in the plugin settings, as this activates the image download pipeline triggered on product post save.</p> <p>The affiliate-toolkit – Multi-Network Affiliate &amp; Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload_image function. This is due to insufficient file type validation in upload_image due to a weak Content-Type prefix check and extension derivation from the attacker-controlled URL path, with no dangerous-extension stripping. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the &#34;import product image&#34; option to be enabled in the plugin settings, as this activates the image download pipeline triggered on product post save.</p> https://db.gcve.eu/vuln/ghsa-6wvw-5jhh-gcg4