Affs Vulnerabilities

The SUMO Affiliates Pro plugin for WordPress is vulnerable to PHP Object Injection in versions up to 11.4.0 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an addi...

CVSS:

8.1

Affected:

up to 11.4.0

Fixed in:

11.4.0

Disclosed:

Mar 18, 2026

CVE-2026-24989 on NVD →

The SUMO Affiliates Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.

CVSS:

4.3

Affected:

up to 11.0.0

Fixed in:

11.1.0

Disclosed:

Nov 4, 2025

CVE-2025-64228 on NVD →

[en] Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Retrieve Embedded Sensitive Data.This issue affects SUMO Affiliates Pro: from n/a through <= 11.0.0.

Affected:

up to 11.0.0

Fix:

No patched version reported

Disclosed:

Oct 29, 2025

CVE-2025-64228 on NVD →

[en] Unrestricted Upload of File with Dangerous Type vulnerability in FantasticPlugins SUMO Affiliates Pro allows Using Malicious Files. This issue affects SUMO Affiliates Pro: from n/a through 10.7.0.

Affected:

up to 10.7.0

Fix:

No patched version reported

Disclosed:

Jun 9, 2025

CVE-2025-32291 on NVD →

The SUMO Affiliates Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and excluding, 11.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possibl...

CVSS:

9.8

Affected:

up to 11.1.0

Fixed in:

11.1.0

Disclosed:

May 30, 2025

CVE-2025-32291 on NVD →