Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows… (CVE-2026-104398)

The VillaTheme AFFI – Affiliate Marketing for WooCommerce plugin (affi-affiliate-marketing-for-woo) contains a deserialization of untrusted data vulnerability (CVE-2026-104398) affecting all versions up to and including 1.0.10. This vulnerability enables an attacker to perform object injection attacks by exploiting unsafe deserialization processes. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack can be executed remotely over the network without authentication or user interaction, resulting in complete compromise of confidentiality, integrity, and availability of the affected system.

Successful exploitation can lead to remote code execution, full system compromise, and complete loss of confidentiality, integrity, and availability of the affected environment. Because no privileges or user interaction are required, the vulnerability poses a critical risk to any system running the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the affected plugin, disable or remove the plugin if possible, and monitor for suspicious activity related to object injection attempts.