itthinx Affiliates Deserialization Bug CVE-2026-108291 Hits 9.8 CVSS for Versions Up to 7.0.1

A critical object injection vulnerability has been identified in the itthinx Affiliates WordPress plugin, exposing sites running versions up to 7.0.1 to potential exploitation. The National Vulnerability Database lists the issue as CVE-2026-108291, assigning it a maximum severity score of 9.8. This flaw stems from the improper handling of untrusted data during deserialization processes within the plugin’s codebase. Security teams monitoring WordPress environments should assess their installations immediately to determine if this component is present and vulnerable.

Root cause

The underlying technical issue is classified under CWE-502, which covers the deserialization of untrusted data. The itthinx Affiliates plugin fails to adequately validate or sanitize data before deserializing it, creating an opening for object injection. This weakness allows an attacker to manipulate the serialized data stream, forcing the application to instantiate arbitrary objects. Such manipulation can lead to unintended code execution paths that bypass standard application logic and security controls.

Attack path

An attacker can exploit this vulnerability by sending crafted requests containing malicious serialized data. This action triggers the object injection flaw within the itthinx Affiliates plugin. The source material states that this issue allows object injection but does not specify whether authentication is required. The result is the successful injection of objects, which may lead to further compromise depending on the application's handling of the injected data.

Affected versions

The vulnerability impacts a wide range of the plugin’s history. According to the NVD record, the issue affects itthinx Affiliates versions starting from the earliest available release up through version 7.0.1. Any installation running version 7.0.1 or lower is considered vulnerable. Users who have not updated to a version newer than 7.0.1 remain exposed to this critical risk. There is no indication in the source material that versions beyond 7.0.1 exist or are safe.

Mitigation

• Review all WordPress installations for the presence of the itthinx Affiliates plugin.
• Verify the installed version against the affected range ending at 7.0.1.
• Remove the plugin if it is no longer needed to eliminate the attack surface.
• Monitor server logs for signs of exploitation while waiting for vendor guidance.

Signals worth monitoring

Teams usually detect this type of activity by reviewing web server access logs for unusual request patterns. Look for POST requests containing base64-encoded strings or serialized PHP objects that do not match expected application data. Check for spikes in CPU or memory usage that may indicate background code execution. Inspect file integrity monitoring alerts for unexpected changes to core WordPress files or new executable scripts. Review database logs for anomalous queries that could result from object instantiation.

What to do and how to stay safe: itthinx Affiliates

• Audit your plugin inventory to confirm whether itthinx Affiliates is installed on any production servers.
• Check the current version number against the vulnerable range ending at 7.0.1 to determine exposure.
• Isolate affected servers from the network if you suspect active exploitation or unauthorized access.
• Wait for an official update from the vendor before reinstalling the plugin, or switch to an alternative solution.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for the itthinx Affiliates vulnerability?

The National Vulnerability Database assigns a CVSS score of 9.8 to CVE-2026-108291, rating it as critical.

Which versions of itthinx Affiliates are affected by this flaw?

All versions of the itthinx Affiliates plugin from the initial release through version 7.0.1 are affected.

Does the source material specify if authentication is required to exploit this?

No, the source material does not specify whether authentication is required to exploit the object injection vulnerability.