Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Auto Amazon Links Plugin for WordPress Allows Unauthorized File Access

CVE-2025-11451 · published 11 months ago
Summary

The Auto Amazon Links plugin for WordPress has a security issue that allows hackers to read sensitive files on your server without needing a password. This could expose confidential information. Update to the latest version to fix this issue.

Original advisory text
The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to arbitrary files reads in all versions up to, and including, 5.4.3 via the '/wp-json/wp/v2/aal_ajax_u...
The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to arbitrary files reads in all versions up to, and including, 5.4.3 via the '/wp-json/wp/v2/aal_ajax_unit_loading' RST API endpoint. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-73External Control of File Name or Path
Timeline
Published11 Nov 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-11451 · NVD
Track software like this
Free during beta