External risk intelligence

VillaTheme AFFI Plugin Object Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-104398

The vulnerability affects a WordPress plugin designed for affiliate marketing within WooCommerce. Such plugins are inherently deployed on web servers that are configured as public-facing e-commerce storefronts, making them directly reachable and commonly exposed to the public internet.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the AFFI – Affiliate Marketing for WooCommerce plugin, specifically related to the deserialization of untrusted data, which could allow for object injection. This impacts versions up to and including 1.0.10 and affects how the plugin handles data, potentially leading to unauthorized actions on affected systems. The main concern is confirming the relevance and exposure of this plugin within your e-commerce operations.

Plugin mishandles data, allowing unauthorized actions.
Affiliates and e-commerce operations are primary targets.
Confirm if this plugin is in use and impacts operations.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to a vulnerable WooCommerce store that uses the AFFI – Affiliate Marketing for WooCommerce plugin. The plugin's handling of untrusted data allows for object injection, which can lead to complete compromise of the site.

No authentication or user interaction needed.
Triggers via deserialization of untrusted data.
Allows remote code execution and full site compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary code on the server when processing untrusted data, potentially leading to a compromise of the WooCommerce store's backend and its associated data.

Affected WooCommerce store data.
Malicious data input during processing.
Server compromise and data exfiltration.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the AFFI – Affiliate Marketing for WooCommerce plugin likely impacts e-commerce platforms, indicating that WooCommerce administrators and the platform or infrastructure teams managing the web servers should prioritize investigation. The immediate next step is to identify all instances of the affected plugin, determine their internet reachability and business criticality, and then assign ownership for remediation based on the identified risk.

Identify plugin owner and affected systems.
Verify plugin reachability and business impact.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the AFFI – Affiliate Marketing for WooCommerce plugin?

This is a WordPress plugin developed by VillaTheme that adds affiliate marketing features to WooCommerce stores. It helps store owners manage referral programs, track affiliate sales, and automate commission calculations. It is used to integrate partner marketing directly into e-commerce sites running on the WordPress platform.

How does this CVE-2026-104398 object injection work?

The vulnerability is classified as Deserialization of Untrusted Data (CWE-502). When the plugin processes incoming data incorrectly, it may inadvertently convert malicious input into functional objects within the system. This allows an attacker to manipulate the program's logic, potentially leading to unauthorized actions or remote code execution.

Do I need to be logged in to trigger this vulnerability?

No. The vulnerability does not require authentication or user interaction. An attacker can trigger the flaw simply by sending a specially crafted network request to the affected WooCommerce store. This issue occurs during the data processing stage and is not dependent on the attacker having a registered account or admin privileges.

Why is this a risk for my WooCommerce store?

According to Halo Surface Signal, this plugin is typically deployed on public-facing e-commerce storefronts, making it directly reachable from the internet. Because it is intended to handle traffic from outside users, it faces a high risk of being targeted by external automated requests attempting to exploit this deserialization weakness.

Is there a recommended first step for administrators?

Your priority is to identify all websites in your environment that have the AFFI plugin installed. Once you have an inventory, confirm the specific version in use to see if it falls within the affected range (up to 1.0.10). After identifying these instances, assess their importance to your operations so you can coordinate an update or mitigation strategy.

References

patchstack.com/database/wordpress/plugin/affi-affiliate-marketing-fo…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.