# YITH WooCommerce Affiliates <= 3.31.0 - Authenticated (Shop Manager+) PHP Object Injection via Referral Cookie Expiration Setting

- **ID:** WPSEC-2026-0650
- **Plugin:** YITH WooCommerce Affiliates (`yith-woocommerce-affiliates`), https://wordpress.org/plugins/yith-woocommerce-affiliates/
- **Affected versions:** from 2.0.0 before 3.31.1
- **Fixed in:** 3.31.1 (Update to 3.31.1 or later.)
- **Severity:** Medium 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-502
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-08)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/yith-woocommerce-affiliates
- **Fix released:** 2026-10-07
- **Published:** 2026-10-08
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0650/

## Description

The YITH WooCommerce Affiliates plugin for WordPress is vulnerable to PHP Object Injection in versions 2.0.0 up to, and including, 3.31.0 via the 'Referral cookies expire after' setting. The setting's value is saved without sanitization, and the bundled YITH plugin framework later passes it to maybe_unserialize() when the settings page is displayed. This makes it possible for authenticated attackers with Shop Manager-level access and above to inject a PHP object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

## References

- https://wpsec.com/vuln/WPSEC-2026-0650/
- https://plugins.svn.wordpress.org/yith-woocommerce-affiliates/tags/3.31.1/
- https://wordpress.org/plugins/yith-woocommerce-affiliates/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0650/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.