CVE-2026-108291

Deferred Deferred - Pending Action

Deserialization of Untrusted Data in itthinx Affiliates

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Patchstack

Description

Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-108291

EUVD

EUVD-2026-101017

Affected Vendors & Products

Vendor	Product	Version / Range
itthinx	Affiliates	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This is a Deserialization of Untrusted Data vulnerability in the itthinx Affiliates WordPress plugin versions 7.0.1 and below. It allows Object Injection, meaning unauthenticated attackers can manipulate data processing on the server by injecting malicious objects during deserialization.

Detection Guidance

Check if the WordPress Affiliates Plugin version is 7.0.1 or below. Look for unusual server behavior or unexpected data processing. Use security tools to scan for PHP Object Injection attempts in web traffic.

Impact Analysis

This vulnerability can allow attackers to execute harmful actions on your server without authentication. It poses a critical risk (CVSS 9.8) and may lead to complete system compromise, data theft, or further attacks. Mass-exploit campaigns are expected.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update the Affiliates Plugin to version 7.1.0 or later immediately. Apply Patchstack's mitigation rule to block attacks until the update is complete. Monitor server logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-108291. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70