{
 "id": "WPSEC-2026-0650",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0650/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0650/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0650/index.md",
 "title": "YITH WooCommerce Affiliates <= 3.31.0 - Authenticated (Shop Manager+) PHP Object Injection via Referral Cookie Expiration Setting",
 "description": "The YITH WooCommerce Affiliates plugin for WordPress is vulnerable to PHP Object Injection in versions 2.0.0 up to, and including, 3.31.0 via the 'Referral cookies expire after' setting. The setting's value is saved without sanitization, and the bundled YITH plugin framework later passes it to maybe_unserialize() when the settings page is displayed. This makes it possible for authenticated attackers with Shop Manager-level access and above to inject a PHP object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
 "plugin": {
  "slug": "yith-woocommerce-affiliates",
  "name": "YITH WooCommerce Affiliates",
  "full_name": "YITH WooCommerce Affiliates",
  "wordpress_org": "https://wordpress.org/plugins/yith-woocommerce-affiliates/",
  "advisories_url": "https://wpsec.com/vuln/plugin/yith-woocommerce-affiliates/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/yith-woocommerce-affiliates"
 },
 "type": "OBJECT INJECTION",
 "cwe": [
  "CWE-502"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.6,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.0.0",
    "from_inclusive": true,
    "to": "3.31.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.0.0 before 3.31.1"
  ]
 },
 "introduced_in": "2.0.0",
 "fixed_in": "3.31.1",
 "remediation": "Update to 3.31.1 or later.",
 "fix_released": "2026-10-07T12:22:06+00:00",
 "published": "2026-10-08T12:49:15+00:00",
 "updated": "2026-10-07T14:56:13.844762+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0650/",
  "https://plugins.svn.wordpress.org/yith-woocommerce-affiliates/tags/3.31.1/",
  "https://wordpress.org/plugins/yith-woocommerce-affiliates/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/yith-woocommerce-affiliates",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-08"
 }
}