Arbitrary File Upload Vulnerability in Multi-Network Affiliate & Amazon Product Display Plugin for WordPress

CVE-2026-111255

What is CVE-2026-111255?

The Multi-Network Affiliate & Amazon Product Display plugin for WordPress is susceptible to an arbitrary file upload vulnerability across all versions up to and including 3.9.2. This issue arises from inadequate file type validation in the upload_image function, allowing authenticated attackers with contributor-level access or above to upload potentially executable files. The weakness lies in the ineffective Content-Type prefix check and the lack of stripping dangerous file extensions from the attacker-controlled URL path. If the 'import product image' feature is enabled in the plugin settings, this vulnerability could be exploited to trigger a remote code execution attack by leveraging the image download process upon saving a product post.

References