Yith Woocommerce Affiliates
Monthly
PHP Object Injection in YITH WooCommerce Affiliates through version 3.31.0 allows an authenticated attacker who already holds a high-privilege WordPress account to deserialize untrusted input and potentially achieve code execution or otherwise tamper with the site, with high impact to confidentiality, integrity, and availability (CVSS 7.2). The flaw is network-reachable without user interaction, but the PR:H requirement is the key limiter: unprivileged or unauthenticated users cannot reach the vulnerable deserialization path. No public exploit identified at time of analysis and no EPSS score was provided; the primary mitigations are reducing high-privilege accounts and applying a vendor fix once one ships.
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
PHP Object Injection in YITH WooCommerce Affiliates through version 3.31.0 allows an authenticated attacker who already holds a high-privilege WordPress account to deserialize untrusted input and potentially achieve code execution or otherwise tamper with the site, with high impact to confidentiality, integrity, and availability (CVSS 7.2). The flaw is network-reachable without user interaction, but the PR:H requirement is the key limiter: unprivileged or unauthenticated users cannot reach the vulnerable deserialization path. No public exploit identified at time of analysis and no EPSS score was provided; the primary mitigations are reducing high-privilege accounts and applying a vendor fix once one ships.
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.