{"id":"CVE-2026-108291","published":"2026-10-14T13:17:24.633","lastModified":"2026-10-15T17:17:14.040","description":"Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/affiliates/vulnerability/wordpress-affiliates-plugin-7-0-1-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to inject malicious objects during deserialization, potentially leading to remote code execution or complete system compromise. The flaw exists in the Affiliates plugin's handling of untrusted data.","exploitability":"Exploitation is relatively straightforward with no special preconditions required, as it's a direct object injection vulnerability in a web application.","blast_radius":"If exploited, this could allow attackers to execute arbitrary code on the affected WordPress site, potentially leading to full compromise of the entire website and its data.","remediation":"Upgrade to version 7.0.2 or later to remediate this deserialization vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","deserialization","wordpress","web"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:47:27.128Z"}}