Affiliate-toolkit vulnerabilities
We track 2 vulnerabilities in Affiliate-toolkit products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
2vulnerabilities
1critical
1high
0exploited
8.5average CVSS score
Latest Affiliate-toolkit vulnerabilities
- 7.2 High severity
affiliate-toolkit: Improper Control of Generation of Code
The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP co
- 9.8 Critical severity
affiliate-toolkit: Missing Authorization
The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RF