itthinx Affiliates CVE-2026-108291

Exploitation requires reaching a code path in the Affiliates plugin (versions through 7.0.1) that deserializes attacker-controlled input via unserialize(), and critically requires a usable PHP POP gadget chain to be present in the plugin, WordPress core, or another installed plugin/theme for the object injection to produce meaningful impact - object injection without an available gadget chain typically yields limited or no effect. The supplied CVSS vector marks the sink as reachable remotely without authentication or user interaction (PR:N/UI:N), so the primary limiting factor is gadget-chain availability rather than access; defenders running the plugin alongside other components that expose gadget chains face materially higher real risk. Mitigation is bounded to installations running Affiliates 7.0.1 or earlier.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, base 9.8) describes a critical, remotely and unauthenticatedly exploitable flaw, which is the standard Patchstack scoring for PHP Object Injection (CWE-502). However, this score should be treated cautiously: real-world exploitability of PHP object injection is gated on the presence of a usable POP (property-oriented programming) gadget chain, which is not guaranteed by the deserialization sink alone - this is a signal the raw 9.8 does not capture, and why my independent assessment raises attack complexity to AC:H. There is no EPSS score, no CISA KEV listing, and no public POC referenced in the provided data, so there is currently no evidence of active or imminent exploitation; the only intelligence source is a single Patchstack advisory. Net: this is a legitimately serious, patch-worthy vulnerability in a public-facing CMS plugin and should be remediated promptly, but in the absence of KEV/EPSS/POC signals it ranks as 'prioritize-but-not-emergency' rather than a confirmed in-the-wild threat. Key missing data (exploitation probability, POC availability, whether a gadget chain ships with the plugin) should be verified against the Patchstack advisory before treating it as drop-everything.

A remote attacker submits attacker-controlled serialized PHP data to a plugin endpoint that passes it to an unserialize() call, instantiating arbitrary objects. If a suitable POP gadget chain is present in the plugin or another installed WordPress component, this object injection can cascade into file write/delete, SQL injection, or remote code execution. No public exploit code is referenced, and successful exploitation depends on an available gadget chain rather than the deserialization flaw alone.