The affiliate‑toolkit WordPress plugin (cservit:affiliate‑toolkit) contains a flaw that allows authenticated users with contributor‑level permissions to upload arbitrary files by manipulating the 'atkp_product_largeimageurl' parameter. The upload_image function performs only a weak content‑type prefix check and derives the file extension from the attacker‑controlled URL path, with no stripping of dangerous extensions. Consequently, malicious files that could be executed on the server can be uploaded, giving the attacker remote code execution capabilities.

Affected are WordPress sites that have the affiliate‑toolkit Multi‑Network Affiliate & Amazon Product Display plugin installed at any version up to and including 3.9.2. The flaw is exploitable only when the plugin’s 'import product image' feature is enabled in the settings, and when a user has contributor or higher access. No specific PHP or OS version dependency is noted, so the vulnerability applies broadly to any environment running the mentioned plugin.

The CVSS score of 7.5 indicates high severity. Although no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the potential for remote code execution remains significant. Exploitation requires an authenticated contributor or higher and the 'import product image' option to be active; no additional privilege escalation or external control is needed beyond legitimate user access. Because the flaw permits arbitrary file uploads on the server, an attacker can place malicious payloads and later trigger execution from within the web application or through other attack surfaces.