Affiliate Toolkit EUVD-2026-111574

Exploitation requires ALL of: (1) an authenticated WordPress account with contributor-level capability or above (consistent with PR:L); (2) the 'import product image' option enabled in the plugin settings - this is the specific non-default configuration that activates the image download pipeline triggered on product post save; and (3) the attacker controlling the image URL so that its path carries a dangerous extension while the HTTP response presents a Content-Type whose prefix passes the weak check. The vulnerable logic is upload_image in ATKPTools.php, which validates by Content-Type prefix only, derives the file extension from the attacker-controlled URL path, and performs no dangerous-extension stripping. Limiting factors that reduce realistic risk: the required authenticated foothold, the required non-default 'import product image' setting, and the high attack complexity (AC:H) reflecting these combined preconditions; sites running the plugin with that import option disabled are not exploitable through this path.

This is a genuinely serious flaw but one whose real-world priority is tempered by its preconditions. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5) describes a network-reachable path to full RCE (C:H/I:H/A:H) but explicitly flags high attack complexity (AC:H) and required low privileges (PR:L). The AC:H and PR:L are consistent with the description: exploitation needs an authenticated contributor-or-above account AND a non-default plugin setting ('import product image') to be enabled, which gates the vulnerable download/upload pipeline. The vuln.today decision label is 'this_week' (urgent but not emergency), and the finding is credited to Wordfence (a credible WordPress-security vendor). No EPSS score, no CISA KEV listing, and no PoC confirmation were supplied in the input - so there is no evidence of active exploitation or weaponization, and 'no public exploit identified at time of analysis' applies. The net picture is a high-severity, real-RCE vulnerability whose exploitation is conditional (requires both a foothold account and a specific setting), making it a 'patch this week' item rather than a drop-everything emergency, concordant with the this_week label. Note the one gentle tension to verify: AV:N plus AC:H here reflects the server-side URL-fetch pipeline, not a simple unauthenticated remote drop - defenders should not read AV:N as 'anonymous internet exploitation.'

An attacker who holds (or phishes/registers) a contributor-level WordPress account on a site where the plugin's 'import product image' option is enabled creates or saves a product post referencing a crafted image URL whose path ends in an executable extension (e.g. .php) and whose response carries a permissive Content-Type prefix. The plugin's upload_image function downloads it, passes the weak Content-Type prefix check, derives the extension from the attacker-controlled URL path, and writes the file without stripping dangerous extensions, yielding a web-accessible executable and remote code execution. No public exploit code was identified in the supplied data.