CVE-2025-11451
📋 TL;DR
This vulnerability allows unauthenticated attackers to read arbitrary files on WordPress servers running the Auto Amazon Links plugin. Attackers can access sensitive files like configuration files, database credentials, or other system files. All WordPress sites using this plugin up to version 5.4.3 are affected.
💻 Affected Systems
- Auto Amazon Links – Amazon Associates Affiliate Plugin for WordPress
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive configuration files (like wp-config.php containing database credentials), followed by database access, privilege escalation, or lateral movement.
Likely Case
Exfiltration of sensitive configuration files, database credentials, or other sensitive data leading to site compromise or data breach.
If Mitigated
Limited impact if file permissions restrict sensitive files or if web server runs with minimal privileges, though arbitrary file reads still provide reconnaissance value.
🎯 Exploit Status
Simple HTTP requests to the REST API endpoint with file path parameters can exploit this vulnerability. Public proof-of-concept code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.4.4 or later
Vendor Advisory: https://plugins.trac.wordpress.org/browser/amazon-auto-links/trunk/readme.txt
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Auto Amazon Links' plugin. 4. Click 'Update Now' if update available. 5. If no update appears, manually download version 5.4.4+ from WordPress.org and replace plugin files.
🔧 Temporary Workarounds
Disable vulnerable REST endpoint
allBlock access to the vulnerable '/wp-json/wp/v2/aal_ajax_unit_loading' endpoint via web server configuration or WordPress filters.
# Apache .htaccess
RewriteEngine On
RewriteRule ^wp-json/wp/v2/aal_ajax_unit_loading - [F,L]
# Nginx configuration
location ~* ^/wp-json/wp/v2/aal_ajax_unit_loading { deny all; }
Disable plugin
allTemporarily disable the Auto Amazon Links plugin until patched.
# WordPress CLI
wp plugin deactivate amazon-auto-links
🧯 If You Can't Patch
- Implement strict file permissions (chmod 600 for sensitive files like wp-config.php)
- Deploy web application firewall (WAF) rules to block requests to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check if plugin version is 5.4.3 or lower in WordPress admin panel or via 'wp plugin list' command.Check Version:
wp plugin list --name=amazon-auto-links --field=versionVerify Fix Applied:
Confirm plugin version is 5.4.4 or higher. Test endpoint access with curl: 'curl -X POST https://yoursite.com/wp-json/wp/v2/aal_ajax_unit_loading' should return proper error, not file contents.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to '/wp-json/wp/v2/aal_ajax_unit_loading' with file path parameters
- Unusual file access patterns from web server process
Network Indicators:
- POST requests to vulnerable endpoint with file traversal patterns (../, absolute paths)
SIEM Query:
web_access_logs WHERE url_path LIKE '%/wp-json/wp/v2/aal_ajax_unit_loading%' AND (request_body CONTAINS '../' OR request_body CONTAINS '/etc/' OR request_body CONTAINS 'wp-config')🔗 References
- https://plugins.trac.wordpress.org/browser/amazon-auto-links/trunk/include/core/component/unit/_common/option/template/AmazonAutoLinks_UnitOutput__TemplatePath.php
- https://plugins.trac.wordpress.org/browser/amazon-auto-links/trunk/include/core/component/unit/_common/output/_abstract/AmazonAutoLinks_UnitOutput_Base.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/568254a4-400d-45ea-8a96-1669b0694d70?source=cve
