// CVE · PUBLISHED 2026-10-14

CVE-2026-108291

itthinx / Affiliates

9.8 · CVSS 3.1Critical

Description

Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.

References

www.cve.org/CVERecord ↗
nvd.nist.gov/vuln/detail/CVE-2026-108291 ↗
patchstack.com/database/wordpress/plugin/affiliates/vulnerability/wordpress-affiliates-plugin-7-0-1-php-object-injection-vulnerability ↗

Related CVEs

← CVE Index: search every CVE from the last 30 days

This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.