The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display WordPress plugin is vulnerable to a full path disclosure vulnerability (CWE-200) because the display_errors setting is enabled, causing error messages to reveal the full filesystem path. This vulnerability affects all versions up to 3.5.5 and allows unauthenticated attackers to obtain the full path of the web application. While this information disclosure does not directly compromise confidentiality or integrity, it can be leveraged in combination with other vulnerabilities to facilitate further attacks. There is no indication of known exploits in the wild. No patch or official fix is currently documented.

The vulnerability exposes the full filesystem path of the web application to unauthenticated attackers, which is classified as a low confidentiality impact. This information alone is not sufficient to compromise the system but can assist attackers in identifying the environment and planning additional attacks if other vulnerabilities exist. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, it is recommended to disable display_errors in the plugin or server PHP configuration to prevent error messages from revealing sensitive path information. Since no official fix is documented, controlling error display is the primary mitigation.