Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue… (CVE-2026-106606)

The YITH WooCommerce Affiliates plugin is affected by a deserialization of untrusted data vulnerability that permits object injection attacks. This vulnerability impacts all versions up to and including 3.31.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject malicious objects via deserialization, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to high-privilege accounts and monitor for suspicious activity related to deserialization processes.