CVE-2026-102390

MediumCVSS 5.3

Published: 01/10/2026(UTC)Updated: 01/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Summary

The AFFI – Affiliate Marketing for WooCommerce plugin for WordPress contains a Missing Authorization vulnerability in versions up to and including 1.0.9. Incorrectly configured access control levels may allow unauthorized users to perform operations they are not permitted to.

Risk Assessment

Risk includes unauthorized access to administrative functions, modification of settings or data, which can lead to integrity and confidentiality breaches.

Recommendation

Update the AFFI – Affiliate Marketing for WooCommerce plugin to the latest version that includes the security fix.

Other vulnerabilities in AFFI – Affiliate Marketing for WooCommerce

CVE-2026-104398Critical
Deserialization of untrusted data vulnerability in the AFFI – Affiliate Marketing for WooCommerce plugin. Allows an attacker to perform object injection. Affects versions up to 1.0.10.

Original NVD description (English source)

Missing Authorization vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.9.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS