AFFI-AFFILIATE-MARKETING-FOR-WOO · CVE-2026-120835 · Package
FIX → 1.0.12
The AFFI – Affiliate Marketing for WooCommerce WordPress plugin deserializes untrusted data, which allows PHP object injection. An attacker who can send crafted input to the plugin may be able to trigger unsafe object behavior on the site.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
WordPress/WooCommerce sites running the AFFI – Affiliate Marketing for WooCommerce plugin at 1.0.11 or earlier. The CVSS vector (PR:L) suggests an attacker needs a low-privilege account, such as an affiliate or customer; the exact entry point is not published. Sites without the plugin, or on 1.0.12+, can skip it.
Not affected if plugin-not-installed
Who cares affiliate-marketing, php-object-injection, woocommerce, wordpress
Upgrade to 1.0.12
Update AFFI – Affiliate Marketing for WooCommerce to 1.0.12 or later (per Patchstack).
Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.11.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.