---
id: "CVE-2026-120835"
page: "https://infrastack.ai/live/CVE-2026-120835"
kind: "vulnerability"
aliases: ["CVE-2026-120835"]
title: "WordPress AFFI affiliate plugin: object injection lets attackers run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "affi-affiliate-marketing-for-woo", "fixed": ["1.0.12"], "affected": "<= 1.0.11", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["affiliate-marketing", "package", "php-object-injection", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-13T15:17:33+00:00"
first_seen_at: "2026-11-13T15:46:16+00:00"
updated_at: "2026-11-13T15:48:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120835", "first_seen_at": "2026-11-13T15:46:16+00:00"}, {"source": "analyst", "url": "https://patchstack.com/database/wordpress/plugin/affi-affiliate-marketing-for-woo/vulnerability/wordpress-affi-affiliate-marketing-for-woocommerce-plugin-1-0-11-php-object-injection-vulnerability", "first_seen_at": "2026-11-13T15:48:38+00:00", "cites": ["https://patchstack.com/database/wordpress/plugin/affi-affiliate-marketing-for-woo/vulnerability/wordpress-affi-affiliate-marketing-for-woocommerce-plugin-1-0-11-php-object-injection-vulnerability"]}]
exploit_sources: []
---

# WordPress AFFI affiliate plugin: object injection lets attackers run code

Link for people: https://infrastack.ai/live/CVE-2026-120835 (this .md is for agents)

The AFFI – Affiliate Marketing for WooCommerce WordPress plugin deserializes untrusted data, which allows PHP object injection. An attacker who can send crafted input to the plugin may be able to trigger unsafe object behavior on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:affi-affiliate-marketing-for-woo affected <= 1.0.11 fixed 1.0.12

## How to check

- WordPress admin > Plugins: check the version of 'AFFI – Affiliate Marketing for WooCommerce' (slug affi-affiliate-marketing-for-woo); 1.0.11 or lower is affected.
- WP-CLI: wp plugin list --name=affi-affiliate-marketing-for-woo --fields=name,version

## Fix

Update AFFI – Affiliate Marketing for WooCommerce to 1.0.12 or later (per Patchstack).

## Timeline

- 2026-11-13T15:46:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120835
- 2026-11-13T15:48:38+00:00 analyst https://patchstack.com/database/wordpress/plugin/affi-affiliate-marketing-for-woo/vulnerability/wordpress-affi-affiliate-marketing-for-woocommerce-plugin-1-0-11-php-object-injection-vulnerability — Patchstack DB (third-party, not vendor page): <=1.0.11 vulnerable, fixed 1.0.12, CVSS 8.8 (vector PR:L, so low-privilege login likely needed; entry point not stated). No PoC or exploitation seen. Not verified: no VillaTheme advisory read. Sibling CVE-2026-104398 (<=1.0.10, fixed 1.0.11) is a separate record.

## Documents

- [advisory] Patchstack: AFFI <= 1.0.11 PHP Object Injection https://patchstack.com/database/wordpress/plugin/affi-affiliate-marketing-for-woo/vulnerability/wordpress-affi-affiliate-marketing-for-woocommerce-plugin-1-0-11-php-object-injection-vulnerability

## From the sources

Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.11.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_