Ji Yuchen

**Name of the Vulnerable Software and Affected Versions** affiliate-toolkit WordPress plugin version 3.4.2 and earlier **Description** The issue is related to a lack of authorization and authentication for requests to the "affiliate-toolkit-starter/tools/atkp imagereceiver.php" endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue. **Recommendations** For versions prior to 3.4.3, update to version 3.4.3 or later to resolve the issue. As a temporary workaround, consider disabling access to the "affiliate-toolkit-starter/tools/atkp imagereceiver.php" endpoint until a patch is available. Restrict access to the endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The Assistant WordPress plugin versions prior to 1.4.4 **Description** The issue arises from the plugin not validating a parameter before making a request to it via `wp remote get()`, which could allow users with a role as low as Editor to perform Server-Side Request Forgery (SSRF) attacks. SSRF is a type of attack where an attacker can trick a server into making requests to internal or external resources, potentially leading to unauthorized access or data exposure. **Recommendations** For versions prior to 1.4.4, update to version 1.4.4 or later to resolve the issue. As a temporary workaround, consider restricting the role of users who have access to the plugin's functionality to minimize the risk of exploitation.