CVE-2026-104398

CriticalCVSS 9.8

Published: 10/10/2026(UTC)Translated: 10/10/2026(UTC)NVD NIST

Summary

Deserialization of untrusted data vulnerability in the AFFI – Affiliate Marketing for WooCommerce plugin. Allows an attacker to perform object injection. Affects versions up to 1.0.10.

Risk Assessment

An attacker could exploit this to execute arbitrary code or take over the site, potentially leading to full system compromise.

Recommendation

Update the AFFI plugin to the latest patched version. Restrict admin panel access and monitor logs for suspicious activity.

Other vulnerabilities in AFFI – Affiliate Marketing for WooCommerce

CVE-2026-102390Medium
The AFFI – Affiliate Marketing for WooCommerce plugin for WordPress contains a Missing Authorization vulnerability in versions up to and including 1.0.9. Incorrectly configured access control levels may allow unauthorized users to perform operations they are not permitted to.

Original NVD description (English source)

Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS