CVE-2026-104398

{
  "etk_id": "ETK-2026-1181",
  "cve_id": "CVE-2026-104398",
  "display_id": "CVE-2026-104398",
  "ghsa_id": "GHSA-qhr7-rxm2-7x33",
  "euvd_id": "EUVD-2026-96380",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Object injection in AFFI for WooCommerce",
  "summary": "AFFI – Affiliate Marketing for WooCommerce versions through 1.0.10 are affected by unsafe deserialization that can permit object injection. The advisory does not establish the access or authentication prerequisites an attacker must meet.",
  "mitigation": "Disable the plugin or restrict access to it where it is not essential, and prevent untrusted input from reaching it. Monitor for a vendor update and upgrade promptly when a fixed release is published.",
  "vendor": "VillaTheme",
  "product": "AFFI – Affiliate Marketing for WooCommerce",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.0.10"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "affi-affiliate-marketing-for-woo",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0034,
  "epss_percentile": 0.258,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 19.15177495,
  "t0_at": "2026-10-10T17:00:10.991000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-10T18:54:03.074383+00:00",
      "days": 0.07907503915509259,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T17:00:10.991000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-10T17:00:10.991000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T17:00:10.991000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104398"
    }
  }
}