Deserialization of untrusted data allows arbitrary PHP object injection, a critical flaw in the WC Affiliate plugin. This improper handling of serialized input can lead to arbitrary code execution, compromising confidentiality, integrity and availability of the affected WordPress site. The weakness is represented by CWE‑502, highlighting insecure deserialization.

The flaw exists in Codexpert, Inc’s WC Affiliate plugin for WordPress versions with the plugin set to 2.16 or earlier. Site administrators using these product releases should verify which version is installed.

Based on the description, it is inferred that the likely attack vector involves the delivery of crafted serialized objects through the plugin's endpoints or other input mechanisms. The CVSS score of 8.8 signals high severity. Although the EPSS score is below 1 %, indicating a low probability of exploitation, the vulnerability remains a significant risk because it can be leveraged remotely if an attacker submits a crafted payload. The flaw is not listed in CISA KEV, but its impact warrants immediate attention. Adversaries could deliver malicious serialized objects via plugin endpoints or other input mechanisms to gain control over the server.