CVE-2023-5877 affiliate-toolkit < 3.4.3 - Unauthenticated SSRF
Unauthenticated attackers can exploit an SSRF vulnerability in the affiliate-toolkit WordPress plugin to access internal network resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-5877?
CVE-2023-5877 is a critical server-side request forgery vulnerability in Unknown affiliate-toolkit, published on 1 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.
Weakness: CWE-862
Which versions are affected by CVE-2023-5877?
It affects 1 product.
Products include Servit Affiliate-Toolkit.
How do I fix CVE-2023-5877?
No fix has been published for CVE-2023-5877 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-5877 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-5877 exists.
Other vulnerabilities in Unknown affiliate-toolkit
- CVE-2023-46086 WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.4.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-1851 affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_create_list
- CVE-2023-23786 WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.3.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2025-46231 WordPress affiliate-toolkit plugin <= 3.7.3 - Cross Site Request Forgery (CSRF) Vulnerability
- CVE-2023-45105 WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.3.9 is vulnerable to Open Redirection
Sources
Also known as GHSA-3hh9-m6jx-r3jg.