The Auto Amazon Links plugin for WordPress is vulnerable to unauthenticated arbitrary file reads, posing a significant risk of sensitive information disclosure.

This vulnerability, categorized under CWE-73, exists in the /wp-json/wp/v2/aal_ajax_unit_loading REST API endpoint. It allows unauthenticated attackers to perform arbitrary file reads on the server, potentially exposing sensitive configuration files or credentials.

The exposure of arbitrary files on a web server can lead to a total compromise of the application environment. By reading sensitive files, such as wp-config.php, attackers can obtain database credentials, API keys, and other secrets, which may lead to further exploitation, data theft, or complete site takeover. Given the CVSS score of 7.5, this is a high-severity issue that requires immediate attention to protect organizational data.

Immediate Action: Discontinue use of the Auto Amazon Links plugin until a patch is released, or verify if a version beyond 5.4.3 has been made available by the vendor. If no patch is available, deactivate and remove the plugin from the WordPress environment immediately to eliminate the attack vector.

Proactive Monitoring: Monitor server access logs for suspicious requests targeting the /wp-json/wp/v2/aal_ajax_unit_loading endpoint, particularly those attempting to traverse directories or access non-standard file extensions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or sanitize requests directed at the specific vulnerable REST API endpoint associated with this plugin.

Public Exploit Available: Unknown.

This vulnerability represents a significant security risk due to the potential for unauthenticated access to sensitive system files. Organizations should prioritize the immediate removal or deactivation of the affected plugin until a vendor-verified fix is confirmed. Ensure that all WordPress plugins are kept up to date and that unnecessary extensions are removed to reduce the overall attack surface of the application.