CVE-2026-106606: WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability
Published Oct 10, 2026
·Updated
Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0.
Affected Software
1 affected component
YITH YITH WooCommerce Affiliates<=3.31.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YITH WooCommerce Affiliatesto a version that resolves this vulnerability.Fixed in 3.31.1
Event History
Oct 10, 2026
CVE Published
via MITRE·07:00 AM
Data Sourced
via MITRE·07:00 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·08:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this vulnerability?
The vulnerability has a high-privileges requirement (PR:H), so an attacker needs high-level privileges before exploitation. It is remotely reachable and requires no user interaction.
2
Which plugin versions are affected?
YITH WooCommerce Affiliates versions through 3.31.0 are affected. The available data does not identify a fixed version.