Description
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.
Published: 2026-10-14
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution
Action: Immediate Patch
AI Analysis

Impact

This vulnerability is a PHP Object Injection flaw caused by the deserialization of untrusted data within the itthinx Affiliates plugin. An attacker who can supply crafted serialized data to the plugin can cause arbitrary code to be executed on the affected WordPress site, potentially allowing full control over the server or data compromise.

Affected Systems

The WordPress Affiliates plugin by itthinx, in all releases from its inception through version 7.0.1, is affected. Users running these versions on WordPress installations are at risk.

Risk and Exploitability

The CVSS score of 9.8 places this flaw in the Critical severity category, and the EPSS score of approximately 0.46% indicates a low but nonzero likelihood of exploitation. While it is not listed in CISA's KEV catalog, the high base score still warrants prompt action from administrators.

Generated by OpenCVE AI on October 15, 2026 at 23:17 UTC.

Remediation

Vendor Solution

Update the WordPress Affiliates plugin to the latest available version (at least 7.1.0).

OpenCVE Recommended Actions

  • Upgrade the WordPress Affiliates plugin to version 7.1.0 or newer to eliminate the deserialization vulnerability.
  • Remove any lingering old plugin files from the WordPress installation to prevent reintroduction of the vulnerable code.
  • Verify that the plugin’s configuration does not expose deserialization functions to external or untrusted input; consider disabling or restricting related features until a patch is applied.

Generated by OpenCVE AI on October 15, 2026 at 23:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Description Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.
Title WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-15T16:43:47.695Z

Reserved: 2026-10-09T17:57:09.806Z

Link: CVE-2026-108291

cve-icon Vulnrichment

Updated: 2026-10-15T16:38:53.055Z

cve-icon NVD

Status : Deferred

Published: 2026-10-14T13:17:24.633

Modified: 2026-10-15T17:17:14.040

Link: CVE-2026-108291

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-15T23:30:13Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data