The Auto Amazon Links – Amazon Associates Affiliate Plugin for WordPress contains an arbitrary file read vulnerability (CWE-73) in all versions up to and including 5.4.3. The vulnerability is exploitable through the '/wp-json/wp/v2/aal_ajax_unit_loading' REST API endpoint without authentication, enabling attackers to read arbitrary files on the server. This could lead to disclosure of sensitive data. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or vendor advisory is currently available.

Successful exploitation allows unauthenticated attackers to read arbitrary files on the affected server, potentially exposing sensitive information. The vulnerability does not impact integrity or availability but has a high confidentiality impact. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider restricting access to the vulnerable REST API endpoint or implementing web application firewall (WAF) rules to block malicious requests targeting '/wp-json/wp/v2/aal_ajax_unit_loading'. Monitor official channels for updates from the vendor regarding patches or fixes.