CVE-2023-31215 CRITICAL

CVE-2023-31215: WordPress Dropshipping & Affiliation with Amazon Plugin <= 2.1.2 is vulnerable to Arbitrary File Upload

Vendor Amadercode Lab
Product Dropshipping & Affiliation with Amazon
Weakness CWE-434 · Unrestricted file upload
Published December 20, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.9/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in AmaderCode Lab Dropshipping & Affiliation with Amazon.This issue affects Dropshipping & Affiliation with Amazon: from n/a through 2.1.2.

Explanation of Vulnerability in Simple Terms

02Summary

The Dropshipping & Affiliation with Amazon plugin for WordPress allows authenticated users with low privileges to upload files without restriction. An attacker can upload malicious files—including PHP scripts—to execute arbitrary code on the site. The vulnerability affects all versions up to 2.1.2 and has a CVSS score of 9.9, indicating severe risk to site integrity and confidentiality.

What an attacker can do

03Attacker Capabilities

Upload and execute malicious files, including PHP code, to take control of the site.

Potential impact on your site

04Site Impact

Site can be fully compromised; attacker gains ability to read/modify data, create admin accounts, or inject malware.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account (e.g., subscriber or contributor role).

Key dates

06Disclosure timeline

December 20, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-14894 Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value) CVE-2026-57827 Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 CVE-2026-56290 Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 CVE-2026-6960 BookingPress Pro <= 5.6 - Unauthenticated Arbitrary File Upload via Signature Custom Field CVE-2026-65885 Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2