The vulnerability CVE-2025-47660 involves deserialization of untrusted data in the WC Affiliate plugin by Codexpert, Inc, specifically in versions up to 2.16. This flaw allows an attacker with at least low privileges to inject malicious objects during deserialization, potentially leading to remote code execution or other severe impacts. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure, modification, or destruction of data and disruption of service. The high CVSS score indicates critical impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the affected plugin and monitor for suspicious activity related to deserialization processes. Avoid using affected versions of WC Affiliate where possible.