CVE-2026-104398: AFFI Plugin Object Injection Vulnerability

CVE-2026-104398 Overview

CVE-2026-104398 is a critical PHP Object Injection vulnerability in the VillaTheme AFFI – Affiliate Marketing for WooCommerce plugin for WordPress. The flaw stems from insecure deserialization of untrusted data [CWE-502] and affects all plugin versions up to and including 1.0.10. An unauthenticated attacker reachable over the network can submit crafted serialized payloads that the plugin deserializes, potentially triggering object injection. When a suitable PHP magic method chain exists in the application scope, exploitation can lead to arbitrary code execution, data tampering, or complete site compromise.

Critical Impact
Unauthenticated attackers can trigger PHP object injection against affected WooCommerce stores, enabling remote code execution and full site takeover depending on available gadget chains.

Affected Products

VillaTheme AFFI – Affiliate Marketing for WooCommerce (affi-affiliate-marketing-for-woo)
All versions from n/a through 1.0.10
WordPress sites running WooCommerce with the plugin enabled

Discovery Timeline

2026-10-10 - CVE-2026-104398 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-104398

Vulnerability Analysis

The plugin processes attacker-controlled input through PHP's unserialize() function without validating or restricting the deserialized object types. When PHP deserializes an object, it instantiates the class and invokes magic methods such as __wakeup(), __destruct(), or __toString() on the reconstructed object. If any class loaded in the WordPress runtime defines these methods in a way that performs sensitive operations, an attacker can chain them into a working exploit known as a POP (Property-Oriented Programming) gadget chain.

WordPress and WooCommerce environments commonly expose numerous gadget candidates through core, themes, and other active plugins. This increases the practical likelihood that object injection translates into code execution, arbitrary file writes, or database manipulation on affected stores.

Root Cause

The root cause is improper handling of serialized input from an untrusted source. The plugin accepts data that reaches a deserialization sink without integrity checks, allow-listing of permitted classes, or migration to a safe format such as JSON. This matches the pattern described in CWE-502: Deserialization of Untrusted Data.

Attack Vector

The vulnerability is exploitable remotely over HTTP without authentication or user interaction. An attacker crafts a serialized PHP object payload referencing an available gadget chain and submits it to the vulnerable plugin endpoint. For technical specifics on the affected sink and payload path, consult the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-104398

Indicators of Compromise

HTTP request bodies or query parameters containing serialized PHP markers such as O:, a:, s:, or C: targeting plugin endpoints under /wp-content/plugins/affi-affiliate-marketing-for-woo/.
Unexpected PHP files written under wp-content/uploads/ or plugin directories following requests to the plugin.
New or modified WordPress administrator accounts, scheduled tasks, or wp_options entries that correlate with suspicious plugin traffic.

Detection Strategies

Inspect web server and WAF logs for requests to AFFI plugin endpoints containing serialized object patterns in POST bodies, cookies, or URL parameters.
Hunt for PHP processes spawning shell interpreters (sh, bash, cmd.exe) or outbound connections initiated by the web server user shortly after plugin requests.
Monitor file integrity across wp-content/plugins/ and wp-content/uploads/ for unexpected PHP file creation.

Monitoring Recommendations

Enable verbose logging for the WooCommerce and AFFI plugin paths and forward logs to a centralized analytics platform.
Alert on anomalous administrative actions originating from newly created accounts or unusual IP addresses.
Correlate web application telemetry with endpoint process events to identify post-exploitation activity on the hosting server.

How to Mitigate CVE-2026-104398

Immediate Actions Required

Deactivate the AFFI – Affiliate Marketing for WooCommerce plugin on all affected sites until a patched version is confirmed installed.
Deploy WAF rules that block requests containing serialized PHP object patterns targeting the plugin endpoints.
Audit WordPress administrator accounts, scheduled tasks, and plugin files for signs of exploitation.

Patch Information

At the time of publication the enriched CVE data lists affected versions through 1.0.10 and does not identify a fixed release. Monitor the Patchstack advisory and the vendor's WordPress.org plugin page for an updated version that remediates CVE-2026-104398, and apply it as soon as it is released.

Workarounds

Remove or disable the plugin until a patched build is available.
Restrict access to WordPress endpoints associated with the plugin via IP allow-listing or authentication at the reverse proxy.
Place the site behind a WAF with virtual patching rules covering PHP object injection payloads.

bash

# Example: block serialized PHP object patterns in NGINX before they reach WordPress
location ~* /wp-content/plugins/affi-affiliate-marketing-for-woo/ {
    if ($request_body ~* "(^|&|=)O:[0-9]+:\"") { return 403; }
    if ($args ~* "O%3A[0-9]+%3A%22") { return 403; }
}