Loading vulnerability…
PHP object injection in VillaTheme AFFI – Affiliate Marketing for WooCommerce
CVE-2026-104398 is an untrusted-data deserialization vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affecting versions through 1.0.10; the lower affected-version bound is unspecified. Deserialization of untrusted data permits PHP object injection. The vulnerable function and further exploitation consequences are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can trigger PHP object injection through deserialization of untrusted data. Specific downstream consequences, including code execution, data access, data modification, or service disruption, are not established.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.