Affiliates
Monthly
PHP object injection in the itthinx Affiliates WordPress plugin (all versions through 7.0.1) allows remote, unauthenticated attackers to reach a code path that deserializes attacker-controlled input via unserialize(), which can lead to full object injection against the affected site. The supplied CVSS 3.1 vector scores it 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), while our independent assessment applies AC:H because meaningful exploitation depends on the presence of a usable PHP POP gadget chain in the plugin, WordPress core, or another installed plugin/theme; without such a chain the practical effect is usually limited. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but sites running Affiliates 7.0.1 or earlier alongside components that expose gadget chains face materially elevated risk.
PHP object injection in the itthinx Affiliates WordPress plugin (all versions through 7.0.1) allows remote, unauthenticated attackers to reach a code path that deserializes attacker-controlled input via unserialize(), which can lead to full object injection against the affected site. The supplied CVSS 3.1 vector scores it 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), while our independent assessment applies AC:H because meaningful exploitation depends on the presence of a usable PHP POP gadget chain in the plugin, WordPress core, or another installed plugin/theme; without such a chain the practical effect is usually limited. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but sites running Affiliates 7.0.1 or earlier alongside components that expose gadget chains face materially elevated risk.