AFFI Affiliate Marketing EUVD-2026-96380

Exploitation requires the AFFI - Affiliate Marketing for WooCommerce plugin (version through 1.0.10) to be installed and active on a WordPress/WooCommerce site, with an attacker-reachable code path that passes untrusted input to PHP unserialize(). The CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is required to reach the vulnerable endpoint. The principal limiting factor is inherent to PHP Object Injection: meaningful impact (RCE, file write, data access) depends on a usable POP gadget chain existing within the plugin, WordPress core, WooCommerce, or other installed plugins - absent such a chain, the object injection may not yield full code execution. No specific non-default configuration setting was named in the description.

All signals align toward high nominal severity but real-world priority is more nuanced. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) describes unauthenticated, remote, low-complexity exploitation with total impact - consistent with CWE-502 PHP Object Injection. However, no EPSS score, no CISA KEV listing, and no POC/exploit evidence were supplied, so exploitation is currently theoretical: no public exploit identified at time of analysis. A critical caveat specific to CWE-502 object injection: achieving code execution or full compromise typically requires a usable POP (property-oriented programming) gadget chain reachable from the plugin or co-installed code; where no such chain exists the practical impact may be lower than the CVSS C:H/I:H/A:H suggests. This means the 9.8 reflects worst-case potential rather than a confirmed, drop-in RCE. Net assessment: treat as a high-priority patch for sites actually running this plugin, but the absence of KEV/EPSS/POC signals indicates no evidence of active or widespread exploitation yet - the urgency is driven by the vulnerability class and unauthenticated vector, not by observed attacks.

A remote, unauthenticated attacker submits a crafted request containing a malicious serialized PHP payload to an endpoint of the AFFI plugin that passes attacker-controlled data to unserialize(). If a suitable POP gadget chain is present, the injected object triggers unintended method execution during deserialization, potentially leading to arbitrary file operations, SQL interaction, or remote code execution on the WordPress host. No public proof-of-concept was provided in the intelligence, so exploitation depends on an attacker independently identifying a reachable sink and gadget chain.