{"id":"CVE-2026-104398","published":"2026-10-10T17:16:59.937","lastModified":"2026-10-13T13:28:15.717","description":"Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/affi-affiliate-marketing-for-woo/vulnerability/wordpress-affi-affiliate-marketing-for-woocommerce-plugin-1-0-10-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to inject malicious objects during deserialization, potentially leading to remote code execution or complete system compromise. The flaw occurs in the AFFI plugin's handling of untrusted data, making it a critical security risk.","exploitability":"Exploitation is relatively straightforward with no special preconditions required, as the vulnerability exists in a web-facing plugin that processes user input without proper sanitization.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the affected WordPress site, potentially leading to full system compromise and data theft across all connected affiliate marketing data.","remediation":"Upgrade to version 1.0.11 or later to remediate this deserialization vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["deserialization","rce","wordpress"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:45:55.520Z"}}