{"uuid": "c262e7f3-24f0-4ed9-8ac4-b37ee09f0550", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-104398", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117419333265810798", "content": "Deserialization of untrusted data in VillaTheme AFFI for WooCommerce (<=1.0.10) \u2014 CVE-2026-104398 (CRITICAL, CVSS 9.8) enables remote code execution with no auth/user input. Restrict or remove plugin until patched. https://radar.offseq.com/threat/deserialization-of-untrusted-data-vulnerability-in-villatheme-affi-affiliate-marketing-for-woocommerce-3d8236ba80fe5b3c #OffSeq #CVE2026104398 #WordPress #Infosec", "creation_timestamp": "2026-10-11T00:00:40.588721Z"}