CVE-2026-108291: WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability
Published Oct 14, 2026
·Updated
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.
Affected Software
1 affected component
itthinx Affiliates<=7.0.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Affiliates pluginto a version that resolves this vulnerability.Fixed in 7.1.0
Event History
Oct 14, 2026
CVE Published
via MITRE·12:08 PM
Data Sourced
via MITRE·12:08 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
The affected product is the itthinx Affiliates WordPress plugin. Versions through 7.0.1 are affected; the earliest affected version is not specified.
2
Does exploitation require authentication or user interaction?
No. The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
3
What is the potential impact of successful exploitation?
The supplied severity data rates the issue critical at 9.8 and indicates high impact to confidentiality, integrity, and availability.