CVE-2026-108291

CVE-2026-108291 · WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.

CVSS 9.8 · Critical · EPSS 0.5% · Fix available

Published: 2026-10-14T12:08:28.433Z
Updated: 2026-10-15T16:43:47.695Z

Affected products and versions

affiliates
Versions
- ≥ 0, ≤ 7.0.1: Affected; ≥ 7.1.0: Not affected (custom)
Update to 7.1.0

Original sources

https://patchstack.com/database/wordpress/plugin/affiliates/vulnerability/wordpress-affiliates-plugin-7-0-1-php-object-injection-vulnerability?_s_id=cve
https://nvd.nist.gov/vuln/detail/CVE-2026-108291

Check your server →