Description
Auto Amazon Links – Amazon Associates Affiliate Plugin 插件在 WordPress 5.4.3 及以下版本中，存在任意文件读取漏洞。攻击者可通过访问 '/wp-json/wp/v2/aal_ajax_unit_loading' REST API 接口，在未经身份验证的情况下读取服务器上的任意文件。这些文件可能包含敏感信息，如数据库凭证、配置文件等，严重威胁系统的安全。
WordPress Auto Amazon Links /wp-json/wp/v2/aal_ajax_unit_loading 文件读取漏洞（CVE-2025-11451）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-11451
https://avd.aliyun.com/detail?id=AVD-2025-11451
https://cve.imfht.com/detail/CVE-2025-11451
https://www.nsfocus.net/vulndb/133279
https://access.redhat.com/security/cve/cve-2025-11451
https://github.com/advisories/GHSA-v272-26j6-28cg
https://app.opencve.io/cve/CVE-2025-11451
https://www.redpacketsecurity.com/cve-alert-cve-2025-11451-miunosoft-auto-amazon-links-amazon-associates-affiliate-plugin/