VillaTheme AFFI Object Injection CVE-2026-104398 Grants RCE on WooCommerce v1.0.10
A critical object injection vulnerability in the VillaTheme AFFI plugin allows remote code execution on WooCommerce sites running versions up to 1.0.10.
Key points
- CVE-2026-104398 carries a CVSS score of 9.8, indicating a critical severity level.
- The vulnerability involves deserialization of untrusted data, specifically object injection.
- All versions of the AFFI plugin from its release through version 1.0.10 are affected.
The VillaTheme AFFI – Affiliate Marketing for WooCommerce plugin contains a critical deserialization vulnerability that enables object injection. This flaw, tracked as CVE-2026-104398, allows attackers to execute arbitrary code on servers hosting the plugin. The National Vulnerability Database rates the issue with a CVSS score of 9.8, marking it as critical. Security teams must assess their environments immediately to determine exposure.
Root cause
The underlying weakness is classified as CWE-502, which covers the deserialization of untrusted data. The plugin fails to properly validate or sanitize serialized objects before processing them. This lack of validation allows an attacker to inject malicious objects into the application’s logic. When the application deserializes these crafted objects, it executes the embedded code with the privileges of the web server process.
Attack path
An attacker can exploit this vulnerability by sending specially crafted requests containing serialized PHP objects to the vulnerable plugin. Because the flaw allows object injection, the attacker does not need authentication to trigger the exploit. Successful exploitation results in remote code execution on the affected WooCommerce site. This gives the attacker full control over the server, allowing data theft or further lateral movement within the network.
Affected versions
The vulnerability affects all versions of the VillaTheme AFFI – Affiliate Marketing for WooCommerce plugin from its initial release through version 1.0.10. Sites running any version within this range are vulnerable to object injection attacks. No patched version has been confirmed in the available source material. Administrators should assume that any installation of this plugin prior to a confirmed fix is at risk.
Mitigation
- Identify all WooCommerce sites using the VillaTheme AFFI plugin and check their version numbers.
- Isolate affected servers from public internet access if immediate removal of the plugin is not possible.
- Monitor server logs for unusual PHP execution patterns or unexpected outbound connections.
- Wait for the vendor to release a patched version before restoring normal operations.
What to do and how to stay safe: VillaTheme
- Audit your WordPress plugin inventory to locate any instances of the VillaTheme AFFI plugin.
- Review server access logs for signs of unauthorized code execution or strange serialized data payloads.
- Restrict administrative access to your WooCommerce dashboard to limit potential damage during investigation.
- Once the vendor provides an update, apply it immediately to resolve the deserialization flaw.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-104398?
The National Vulnerability Database assigns a CVSS score of 9.8 to this critical vulnerability.
Which versions of the plugin are affected?
All versions of VillaTheme AFFI – Affiliate Marketing for WooCommerce from the initial release through 1.0.10 are affected.
Is there a patch available for this vulnerability?
No fix has been confirmed yet in the available source material; users should wait for vendor updates.
