Quick answers
- Is CVE-2026-106606 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-106606 being exploited in the wild.
- How severe is CVE-2026-106606?
- High severity, with a CVSS score of 7.2, published 10 October 2026.
- Which products and versions are affected?
- YITH WooCommerce Affiliates through 3.31.0.
- Is there a fix for CVE-2026-106606?
- Yes: fixed in 3.31.1. Until then: As immediate mitigation, update the affected plugin to version 3.31.1 or later. If you cannot update immediately, Patchstack provides a mitigation rule to block attacks until patching is possible.</anigation> </invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-106606 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-106606?
- Check whether you run YITH WooCommerce Affiliates at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 3.31.1
As immediate mitigation, update the affected plugin to version 3.31.1 or later. If you cannot update immediately, Patchstack provides a mitigation rule to block attacks until patching is possible.</anigation> </invoke>
Technical details
The plugin deserializes untrusted data without proper validation, allowing PHP object injection attacks. An unauthenticated attacker can craft malicious serialized data to instantiate arbitrary PHP objects and execute code with the privileges of the web server. This vulnerability has a CVSS score of 7.2 and is fixed in version 3.31.1.
Affected products
- YITH WooCommerce Affiliates through 3.31.0
Timeline
- 2026-10-08: disclosed
- 2026-10-08: patched