CVE-2026-104398 is a critical (CVSS 9.8) PHP object injection vulnerability in AFFI — Affiliate Marketing for WooCommerce, published October 10, 2026. It allows unauthenticated attackers to inject serialized PHP objects that the plugin then deserializes, opening a direct path to remote code execution with no login required at any point.
How PHP Object Injection Leads to RCE
Deserialization vulnerabilities work by exploiting PHP’s unserialize() function (or equivalent) when it processes attacker-supplied data without proper validation — a crafted serialized string can instantiate PHP objects in ways the developer never intended, and if the codebase contains classes with “magic methods” (functions that run automatically on object construction or destruction) that perform dangerous operations, an attacker can chain those together into working code execution. This is the same underlying vulnerability class we’ve covered in other recent plugin CVEs this year, and it’s a recurring pattern specifically because deserializing untrusted input is deceptively easy to get wrong.
Who’s Affected
| Version | Status |
|---|---|
| Through 1.0.10 | Vulnerable — update immediately |
| 1.0.11 or later | Patched (based on the affected-version boundary in CVE tracking data) |
Note: if you’re running AFFI version 1.0.10 specifically because you already patched the earlier, separate CVE-2026-102390 (a lower-severity missing-authorization flaw fixed in 1.0.10), that update does not address this new, more severe issue — a second, newer update to 1.0.11 is required.
What to Do Right Now
- Update AFFI — Affiliate Marketing for WooCommerce to 1.0.11 or later immediately, and confirm the installed version afterward in your plugin list rather than assuming the update applied.
- If you can’t update right away, deactivate the plugin as a temporary measure — no safe workaround exists for an unauthenticated deserialization flaw short of removing the vulnerable code path entirely.
- Review your site for signs of compromise given the flaw is both unauthenticated and critical — check for unfamiliar admin accounts, unexpected files, and unusual outbound connections, particularly if the site has been running a vulnerable version since before this CVE’s October 10 disclosure.
- Don’t assume you’re safe just because you don’t use the affiliate features actively — the vulnerability exists in the plugin’s code regardless of whether you’re actively running an affiliate program through it.
This connects to The WordPress XSS Campaign That Hides Its Own Admin Account — a reminder that updating alone never undoes damage from a flaw that was already exploited before you patched. If you find signs of a completed compromise, see WordPress Site Hacked? Here’s the Recovery Checklist We Actually Use. Want a site checked directly? Get in touch.
Frequently Asked Questions
Is this the same vulnerability as CVE-2026-102390 in the same plugin?
No — they’re separate, distinct vulnerabilities. CVE-2026-102390 is a lower-severity (CVSS 5.3) missing-authorization issue fixed in version 1.0.10. CVE-2026-104398 is a more severe object injection flaw that version 1.0.10 does not fix; you need 1.0.11 specifically.
Does object injection always lead to full remote code execution?
Not automatically — it requires the application to contain exploitable “gadget chain” classes the attacker can leverage. In practice, though, object injection is treated as critical by default because many real-world codebases do contain such chains, and this one is rated CVSS 9.8 specifically because it does.
What should I check if I suspect this was already exploited on my site?
Look for unfamiliar admin accounts, unexpected files in your plugin or uploads directories, and any outbound connections to unfamiliar domains — the same general indicators relevant to any confirmed RCE-class compromise.
Featured image: original illustration.