{"id":"CVE-2026-120835","kind":"vulnerability","aliases":["CVE-2026-120835"],"related":[],"title":"WordPress AFFI affiliate plugin: object injection lets attackers run code","description":"Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.11.","summary":"The AFFI – Affiliate Marketing for WooCommerce WordPress plugin deserializes untrusted data, which allows PHP object injection. An attacker who can send crafted input to the plugin may be able to trigger unsafe object behavior on the site.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"affi-affiliate-marketing-for-woo","fixed":["1.0.12"],"affected":"<= 1.0.11","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["affiliate-marketing","package","php-object-injection","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- WordPress admin > Plugins: check the version of 'AFFI – Affiliate Marketing for WooCommerce' (slug affi-affiliate-marketing-for-woo); 1.0.11 or lower is affected.\n- WP-CLI: wp plugin list --name=affi-affiliate-marketing-for-woo --fields=name,version","fix":"Update AFFI – Affiliate Marketing for WooCommerce to 1.0.12 or later (per Patchstack).","status":"open","published_at":"2026-11-13T15:17:33+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","triaged_at":"2026-11-13T15:48:10+00:00","updated_at":"2026-11-13T15:48:38+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-13T15:48:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress AFFI affiliate plugin: object injection lets attackers run code","impact":"high","summary":"The AFFI – Affiliate Marketing for WooCommerce WordPress plugin deserializes untrusted data, which allows PHP object injection. An attacker who can send crafted input to the plugin may be able to trigger unsafe object behavior on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","affiliate-marketing"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; object injection may allow code execution on the site","analyst_note":"Confirm the fixed version and the reachable entry point from the vendor advisory or the Wordfence/NVD record for CVE-2026-120835.","how_to_check":"- Check whether the `affi-affiliate-marketing-for-woo` plugin is installed and its version in the WordPress admin plugins list\n- Compare the installed version against the range in the advisory: from n/a through `1.0.11`","plain_action":"","product_name":"affi-affiliate-marketing-for-woo","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the AFFI – Affiliate Marketing for WooCommerce plugin up to and including 1.0.11 are in the stated range. The sources do not say which request paths or settings make the object injection reachable, so whether a given site is exposed is unknown. Sites without this plugin installed are not affected.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000758,"input_tokens":4571,"output_tokens":601,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the reachable entry point from the vendor advisory or the Wordfence/NVD record for CVE-2026-120835.","search":"'-120835':13A,16A '-2026':12A,15A '1.0.11':101C 'abl':61B 'affect':92C 'affi':2A,18A,34B,77C,83C,93C 'affi-affiliate-marketing-for-woo':17A,82C 'affili':3A,24B,35B,78C,84C,94C 'affiliate':19A 'affiliate-market':23B 'allow':45B,88C 'attack':8A,50B 'behavior':66B 'code':10A 'craft':54B 'cve':11A,14A 'data':43B,73C 'deseri':41B,70C 'for':21A 'inject':6A,30B,48B 'injection.this':90C 'input':55B 'issu':91C 'let':7A 'market':25B,36B,79C,85C,95C 'marketing':20A 'may':59B 'n/a':99C 'object':5A,29B,47B,65B,89C 'packag':26B 'php':28B,46B 'php-object-inject':27B 'plugin':4A,40B,58B 'run':9A 'send':53B 'site':69B 'trigger':63B 'unsaf':64B 'untrust':42B,72C 'villathem':76C 'vulner':74C 'woo':22A,87C 'woocommerc':31B,38B,81C,97C 'wordpress':1A,32B,39B","nicknames":[],"mitigations":[],"who_affected":"WordPress/WooCommerce sites running the AFFI – Affiliate Marketing for WooCommerce plugin at 1.0.11 or earlier. The CVSS vector (PR:L) suggests an attacker needs a low-privilege account, such as an affiliate or customer; the exact entry point is not published. Sites without the plugin, or on 1.0.12+, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["affiaffiliatemarketingforwoo"],"ptokens":["affi","affiliate","for","marketing","woo"],"labels":["affiliatemarketing","high","package","phpobjectinjection","vendor","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-120835':13A,16A '-2026':12A,15A 'affi':2A,18A 'affi-affiliate-marketing-for-woo':17A 'affili':3A 'affiliate':19A 'attack':8A 'code':10A 'cve':11A,14A 'for':21A 'inject':6A 'let':7A 'marketing':20A 'object':5A 'plugin':4A 'run':9A 'woo':22A 'wordpress':1A","search_b":"'abl':61B 'affi':34B 'affili':24B,35B 'affiliate-market':23B 'allow':45B 'attack':50B 'behavior':66B 'craft':54B 'data':43B 'deseri':41B 'inject':30B,48B 'input':55B 'market':25B,36B 'may':59B 'object':29B,47B,65B 'packag':26B 'php':28B,46B 'php-object-inject':27B 'plugin':40B,58B 'send':53B 'site':69B 'trigger':63B 'unsaf':64B 'untrust':42B 'woocommerc':31B,38B 'wordpress':32B,39B","search_c":"'1.0.11':101C 'affect':92C 'affi':77C,83C,93C 'affi-affiliate-marketing-for-woo':82C 'affili':78C,84C,94C 'allow':88C 'data':73C 'deseri':70C 'injection.this':90C 'issu':91C 'market':79C,85C,95C 'n/a':99C 'object':89C 'untrust':72C 'villathem':76C 'vulner':74C 'woo':87C 'woocommerc':81C,97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120835","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120835","severity":null,"published_at":"2026-11-13T15:17:33+00:00","modified_at":"2026-11-13T15:17:33+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","fetched_at":"2026-11-13T15:46:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120835:3889","url":"https://patchstack.com/database/wordpress/plugin/affi-affiliate-marketing-for-woo/vulnerability/wordpress-affi-affiliate-marketing-for-woocommerce-plugin-1-0-11-php-object-injection-vulnerability","severity":null,"published_at":"2026-11-13T15:48:38+00:00","modified_at":"2026-11-13T15:48:38+00:00","first_seen_at":"2026-11-13T15:48:38+00:00","fetched_at":"2026-11-13T15:48:38+00:00","note":"Patchstack DB (third-party, not vendor page): <=1.0.11 vulnerable, fixed 1.0.12, CVSS 8.8 (vector PR:L, so low-privilege login likely needed; entry point not stated). No PoC or exploitation seen. Not verified: no VillaTheme advisory read. Sibling CVE-2026-104398 (<=1.0.10, fixed 1.0.11) is a separate record.","cites":["https://patchstack.com/database/wordpress/plugin/affi-affiliate-marketing-for-woo/vulnerability/wordpress-affi-affiliate-marketing-for-woocommerce-plugin-1-0-11-php-object-injection-vulnerability"]}],"documents":[{"id":147266,"url":"https://patchstack.com/database/wordpress/plugin/affi-affiliate-marketing-for-woo/vulnerability/wordpress-affi-affiliate-marketing-for-woocommerce-plugin-1-0-11-php-object-injection-vulnerability","title":"Patchstack: AFFI <= 1.0.11 PHP Object Injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}