CVE-2026-106606: WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability

Q: Who can exploit this vulnerability?

The vulnerability has a high-privileges requirement (PR:H), so an attacker needs high-level privileges before exploitation. It is remotely reachable and requires no user interaction.

Q: Which plugin versions are affected?

YITH WooCommerce Affiliates versions through 3.31.0 are affected. The available data does not identify a fixed version.

Published Oct 10, 2026

Updated

Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0.

Affected Software

1 affected component

YITH YITH WooCommerce Affiliates<=3.31.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade YITH WooCommerce Affiliates to a version that resolves this vulnerability.
Fixed in 3.31.1

Event History

Oct 10, 2026

CVE Published

via MITRE·07:00 AM

Data Sourced

via MITRE·07:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

The vulnerability has a high-privileges requirement (PR:H), so an attacker needs high-level privileges before exploitation. It is remotely reachable and requires no user interaction.

Which plugin versions are affected?

YITH WooCommerce Affiliates versions through 3.31.0 are affected. The available data does not identify a fixed version.

CVE-2026-106606: WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

Which plugin versions are affected?