CVE-2023-5877 is a critical (CVSS 9.8 in the record) server-side request forgery in the affiliate-toolkit WordPress plugin before 3.4.3. An unauthenticated visitor can make the site fetch arbitrary URLs, including private network addresses. Update to 3.4.3 or later. WPScan rates the same flaw 7.2 High.
What's affected
- Plugin: affiliate-toolkit (the affiliate-toolkit-starter component) for WordPress.
- Affected: versions before 3.4.3.
- Fixed: 3.4.3, per the NVD record and WPScan.
- Severity: the NVD record says 9.8 Critical. WPScan scores it 7.2 High. The sources disagree, so plan around the higher number.
- Detail from WPScan: partial limits added in 3.3.6 blocked localhost but not other private ranges, so versions between 3.3.6 and 3.4.3 are not safe.
How to check if you're exposed
In the WordPress admin, open Plugins and read the version shown under affiliate-toolkit. With shell access and WP-CLI, this lists every installed plugin with its version, status and whether an update is waiting:
wp plugin list --fields=name,title,version,status,update
Find the row for affiliate-toolkit and compare its version with the fixed version above. On a multisite network, run the same command on each site, because a plugin can be active on some sites and not others. The plugin folder is usually affiliate-toolkit-starter.
Anything below 3.4.3 is affected. Your web server logs can also show whether anyone has called the image receiver endpoint. Search for its file name, atkp_imagereceiver.php, and review the callers and the target addresses if your logs record them:
grep "atkp_imagereceiver" /var/log/nginx/access.log
What to do now
- Update affiliate-toolkit to 3.4.3 or later.
- Search access logs for requests to the image receiver endpoint and note unfamiliar client addresses.
- Block the endpoint at the web application firewall or server level until the update is deployed, if you cannot update immediately.
- Restrict the web server's outbound access to private ranges and cloud metadata addresses at the network layer.
- If the host runs on a cloud platform, check that instance metadata requires a session token, so a request forged from the site cannot read credentials.
Why it matters
The plugin has an endpoint that fetches a URL on behalf of the visitor, but does not check who is asking. That is a missing authorization problem, CWE-862, and the result is server-side request forgery. The web server becomes a proxy that an outsider can aim at addresses the outsider cannot reach directly: internal admin panels, databases with no authentication, or cloud metadata services.
SSRF matters most on cloud hosted sites, where the metadata service can hand out credentials to whatever asks from inside the instance. The partial fix in 3.3.6 is a good lesson in blocklists: closing localhost left every other private range open. The record does not list this CVE as known exploited.
Quick check
Why do the severity scores differ?
The NVD record and WPScan score the impact differently. WPScan treats the effect as a request proxy with limited direct harm. NVD scores the worst case for the network position. Neither is wrong, so plan for the higher one.
Sources
Last reviewed: 19 October 2026.
