WordPress YITH WooCommerce Affiliates PHP Object Injection Vulnerability Advisory

Vulnerability Overview Vulnerability Name: Medium Priority PHP Object Injection Vulnerability in WordPress YITH WooCommerce Affiliates Plugin <= 3.31.0. CVSS Score: 7.2 Risk Level: Medium Priority Publication Date: October 8, 2026 Reporter: Ananda Dhakal (Patchstack) Affected Scope Affected Versions: <= 3.31.0 Fixed Version: 3.31.1 or higher Software Type: WordPress Plugin Risk Description: This vulnerability can be exploited for large-scale attacks, allowing attackers to manipulate how the website processes data, thereby executing harmful operations on the server. Remediation 1. Update the Plugin Immediately: It is recommended to update the plugin to version 3.31.1 or higher as soon as possible to resolve the vulnerability. 2. Use Patchstack Automatic Mitigation: Patchstack has released mitigation rules that can block any attacks before updating to the fixed version. 3. Contact Support: If you are unable to update yourself, please contact your hosting provider or web developer for assistance. Detailed Information Software Name: YITH WooCommerce Affiliates Vulnerability Type: PHP Object Injection CVSS Score: 7.2 Publication Date: October 8, 2026 Reporter: Ananda Dhakal (Patchstack) Timeline Report Date: September 17, 2026 Publication Date: October 8, 2026 Additional Information Patchstack Service: Provides automatic vulnerability mitigation and website security protection. Subscription: You can subscribe to the weekly WordPress security intelligence briefing. Code Block No POC code or exploitation code is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress YITH WooCommerce Affiliates PHP Object Injection Vulnerability Advisory

More from this source