What is the CVSS score of EUVD-2026-15607?

EUVD-2026-15607 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Sumo Affiliates Pro are affected by EUVD-2026-15607?

FantasticPlugins SUMO Affiliates Pro versions prior to 11.4.0 contain a critical PHP object injection vulnerability that allows unauthenticated remote code execution through unsafe deserialization of…. A patch is available.

How to fix or mitigate EUVD-2026-15607?

Within 24 hours: Identify all WordPress instances running FantasticPlugins SUMO Affiliates Pro and document current versions. Within 7 days: Upgrade all affected installations to version 11.4.0 or later per vendor advisory. Within 30 days: Conduct security audit of WordPress environment for unauthorized access, file modifications, or suspicious user accounts created during potential exploitation window.

Sumo Affiliates Pro EUVD-2026-15607

| CVE-2026-24989 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-5c9g-mh76-8jrw

Deserialization Sumo Affiliates Pro

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:48 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

11.4.0

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15607

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through < 11.4.0.

AnalysisAI

A PHP object injection vulnerability exists in FantasticPlugins SUMO Affiliates Pro due to unsafe deserialization of untrusted data (CWE-502). This allows attackers to inject malicious serialized objects, potentially achieving remote code execution or other arbitrary actions depending on available gadget chains in the WordPress environment. All versions before 11.4.0 are affected, and a patch has been made available by the vendor.

Technical ContextAI

The vulnerability stems from unsafe PHP object deserialization practices within the SUMO Affiliates Pro WordPress plugin (cpe:2.3:a:fantasticplugins:sumo_affiliates_pro). CWE-502 (Deserialization of Untrusted Data) describes the core weakness where user-controlled input is passed directly to PHP's unserialize() function or similar deserialization mechanisms without proper validation or sanitization. In WordPress contexts, this is particularly dangerous because the plugin ecosystem often contains numerous available PHP classes (gadget chains) that can be leveraged to achieve remote code execution or privilege escalation. The vulnerability likely occurs in a critical function or hook where affiliate-related data is processed, allowing an attacker to craft malicious serialized payloads that instantiate dangerous object chains.

RemediationAI

Immediately upgrade FantasticPlugins SUMO Affiliates Pro to version 11.4.0 or later to receive the vendor patch that addresses the object injection vulnerability. This is the primary and definitive remediation. Until upgrades can be deployed, implement network-level restrictions on the WordPress admin interface and plugin endpoints to limit exposure to untrusted networks, enforce input validation at the web application firewall level if available, and consider disabling the plugin temporarily in non-production environments to assess impact. Monitor WordPress logs and plugin audit trails for suspicious serialized payloads or unusual object instantiation patterns that may indicate exploit attempts. Verify the upgrade through the vendor advisory and update verification mechanism provided at https://patchstack.com/database/Wordpress/Plugin/affs/vulnerability/wordpress-sumo-affiliates-pro-plugin-11-4-0-php-object-injection-vulnerability.