CVE-2026-104398 VillaTheme CVE debrief

Who should care

Defenders responsible for WooCommerce installations with the AFFI – Affiliate Marketing for WooCommerce plugin should assess exposure and potential impact.

Why it matters

Defenders should prioritize verifying exposure and assessing potential impact due to the critical nature of the vulnerability.

• Potential for critical impact due to Object Injection
• Verification of exposure and impact is necessary

Technical summary

The AFFI – Affiliate Marketing for WooCommerce plugin has a Deserialization of Untrusted Data vulnerability, which allows for Object Injection. This issue affects versions from n/a through 1.0.10. The vulnerability is critical, with a CVSS score of 9.8, indicating a high severity level. Defenders should prioritize verifying exposure and assessing potential impact, as the vulnerability allows for Object Injection, which can lead to critical consequences, including potential code execution and data breaches.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, as the vulnerability allows for Object Injection, which can lead to critical consequences.

Recommended defensive actions

• Verify exposure by checking if the AFFI – Affiliate Marketing for WooCommerce plugin version is within the affected range.
• Assess potential impact and prioritize remediation.
• Monitor for potential exploitation attempts.

Evidence notes

The vulnerability is described as a Deserialization of Untrusted Data issue, allowing for Object Injection. The affected plugin is AFFI – Affiliate Marketing for WooCommerce, versions from n/a through 1.0.10.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.