VillaTheme AFFI Plugin Has Critical Object Injection Vulnerability

The National Vulnerability Database has recorded a critical security flaw in the VillaTheme AFFI – Affiliate Marketing for WooCommerce plugin. This vulnerability, identified as CVE-2026-104398, allows for object injection through the deserialization of untrusted data. The issue poses a significant risk to websites using this specific affiliate marketing tool.

At a glance

CVE

CVE-2026-104398

Product

VillaTheme AFFI – Affiliate Marketing for WooCommerce

CVSS

9.8 Critical

Weakness

insecure deserialization

Exploited

No known exploitation

Security researchers have assigned a CVSS score of 9.8 to this vulnerability, marking it as critical severity. The flaw stems from CWE-502, which relates to the improper handling of untrusted data during deserialization processes. This high score indicates that the vulnerability is easily exploitable and could lead to severe consequences for affected systems.

Vulnerability Context and Technical Details

The core issue lies in how the plugin processes data inputs. According to the NVD record, the vulnerability allows object injection, which can potentially lead to remote code execution or other malicious activities. Deserialization vulnerabilities are particularly dangerous because they can allow attackers to instantiate arbitrary objects within the application environment.

This specific weakness affects the AFFI – Affiliate Marketing for WooCommerce plugin developed by VillaTheme. The plugin is designed to help WooCommerce store owners manage affiliate programs, but this flaw undermines the security of those implementations. The deserialization process fails to properly validate or sanitize the incoming data before processing it.

Affected Versions and Scope

The vulnerability impacts all versions of the VillaTheme AFFI – Affiliate Marketing for WooCommerce plugin up to version 1.0.10. The NVD record explicitly states that the issue affects versions from "n/a through 1.0.10". This means any installation running this plugin at or below this version number is potentially vulnerable to exploitation.

Users who have installed version 1.0.10 or any earlier release are exposed to this risk. There is no mention of a patched version beyond 1.0.10 in the current NVD record. Consequently, site administrators must verify their current plugin version immediately to determine if they fall within this affected range.

What should you do?

Site administrators should audit their WooCommerce installations to check for the presence of the VillaTheme AFFI plugin. If installed, verify the version number against the affected range. Monitor server logs for unusual activity that might indicate exploitation attempts. Prepare to update the plugin once a secure version is released by the vendor.

What to do and how to stay safe: VillaTheme

• Check your WordPress dashboard to see if VillaTheme AFFI – Affiliate Marketing for WooCommerce is installed and note the version number.
• If the version is 1.0.10 or lower, consider disabling the plugin immediately to prevent potential exploitation until a fix is available.
• Monitor server access logs for suspicious requests or unusual data patterns that could indicate an attacker attempting object injection.
• Wait for an official update from VillaTheme that addresses CVE-2026-104398 before re-enabling or updating the plugin.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-104398?

The CVSS score for CVE-2026-104398 is 9.8, which is classified as critical severity.

Which versions of VillaTheme AFFI are affected by this vulnerability?

All versions of VillaTheme AFFI – Affiliate Marketing for WooCommerce up to and including version 1.0.10 are affected.

Is there a patch available for this vulnerability?

The source material does not confirm the availability of a patched version beyond 1.0.10.