CVE-2023-5877

Name of the Vulnerable Software and Affected Versions affiliate-toolkit WordPress plugin version 3.4.2 and earlier

Description The issue is related to a lack of authorization and authentication for requests to the "affiliate-toolkit-starter/tools/atkp imagereceiver.php" endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.

Recommendations For versions prior to 3.4.3, update to version 3.4.3 or later to resolve the issue. As a temporary workaround, consider disabling access to the "affiliate-toolkit-starter/tools/atkp imagereceiver.php" endpoint until a patch is available. Restrict access to the endpoint to minimize the risk of exploitation.