CVE-2026-108291
9.8CriticalPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-502
Impact
Unauthenticated remote attackers can execute arbitrary code, manipulate files, or compromise the host via PHP Object Injection. They only need network access to send crafted payloads to the WordPress site.
Root cause
The plugin unsafely deserializes untrusted user input without proper validation.
Affected systems
itthinx Affiliates plugin for WordPress through version 7.0.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade the Affiliates plugin to a version newer than 7.0.1 as soon as released. If an update is unavailable, deactivate or remove the plugin immediately via the WordPress admin panel or CLI.
$ wp plugin deactivate affiliatesAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.