CVE-2026-104398: Deserialization of Untrusted Data in VillaTheme AFFI – Affiliate Marketing for WooCommerce

The vulnerability identified as CVE-2026-104398 affects the VillaTheme AFFI – Affiliate Marketing for WooCommerce plugin, specifically versions from initial release up to 1.0.10. It involves deserialization of untrusted data, which enables an attacker to perform object injection attacks. The CVSS 3.1 score is 9.8, reflecting network attack vector, low complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. This vulnerability could allow remote attackers to execute arbitrary code or cause denial of service by exploiting unsafe deserialization mechanisms within the plugin.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker can remotely execute arbitrary code or manipulate application behavior without authentication or user interaction, posing a critical risk to affected WooCommerce installations using this plugin.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the affected plugin to mitigate risk.