YITH WooCommerce Affiliates <= 3.31.0 - Authenticated (Shop Manager+) PHP Object Injection via Referral Cookie Expiration Setting
- ID
- WPSEC-2026-0650
- Plugin
- YITH WooCommerce Affiliates (yith-woocommerce-affiliates)
- Affected
- from 2.0.0 before 3.31.1
- Remediation
- Update to 3.31.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-502
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-08
- Attack surface
- YITH WooCommerce Affiliates on WPSec AttackSurface
- Fix released
- Published
Description
The YITH WooCommerce Affiliates plugin for WordPress is vulnerable to PHP Object Injection in versions 2.0.0 up to, and including, 3.31.0 via the 'Referral cookies expire after' setting. The setting's value is saved without sanitization, and the bundled YITH plugin framework later passes it to maybe_unserialize() when the settings page is displayed. This makes it possible for authenticated attackers with Shop Manager-level access and above to inject a PHP object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
References
- https://wpsec.com/vuln/WPSEC-2026-0650/
- https://plugins.svn.wordpress.org/yith-woocommerce-affiliates/tags/3.31.1/
- https://wordpress.org/plugins/yith-woocommerce-affiliates/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS