YITH WooCommerce Affiliates CVE-2026-106606

Exploitation requires the attacker to already hold a high-privilege account (PR:H) on the target WordPress site with the YITH WooCommerce Affiliates plugin (version 3.31.0 or earlier) installed and active, and depends on a usable PHP object-injection gadget chain being present in the plugin, WooCommerce, or WordPress core to convert the unserialize primitive into concrete impact. The attack is network-reachable (AV:N), low-complexity (AC:L), and needs no user interaction (UI:N), but the high-privilege prerequisite is the key limiting factor - unprivileged or unauthenticated users cannot reach the vulnerable deserialization path based on the provided CVSS data.

This is a PHP Object Injection (CWE-502, deserialization of untrusted data) flaw in the YITH WooCommerce Affiliates plugin affecting all versions through 3.31.0, reported by Patchstack. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) describes a network-reachable, low-complexity attack with full CIA impact, but critically requires PR:H - high privileges, meaning the attacker must already hold an administrative or equivalently privileged account on the WordPress/WooCommerce site. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The PR:H requirement is the dominant mitigating signal: although the technical impact is high, a high-privilege prerequisite sharply limits real-world exploitability since an attacker with admin access already controls much of the site. The combination of high CVSS impact but high-privilege gating means this is a meaningful hardening priority rather than an emergency; absence of EPSS/KEV/POC data should be treated as unknown rather than confirmed-low risk. Treat this as a moderate, patch-in-normal-cycle issue unless the site delegates privileged roles to semi-trusted users.

An attacker who has obtained a high-privilege account (e.g. administrator or a role permitted to manage the affiliate plugin) submits a crafted serialized PHP payload to an input the plugin unserializes, triggering PHP Object Injection. By leveraging a suitable gadget chain present in the plugin, WooCommerce, or WordPress core, the deserialized object can be abused to achieve code execution or full data compromise. No public proof-of-concept was identified in the provided data.