CVE-2024-13556 is a high severity (CVSS 8.1) PHP object injection in the Affiliate Links link cloaking plugin for WordPress, in versions up to and including 3.0.1. It comes from deserializing an exported file. The impact depends on other installed code. Update past 3.0.1.
What's affected
- Affiliate Links: WordPress Plugin for Link Cloaking and Link Management, all versions up to and including 3.0.1.
The record does not name a fixed version, but it links a code changeset. Check the plugin page for a release newer than 3.0.1.
How to check if you're exposed
Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.
wp plugin list --format=table | grep -i affiliate
Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.
What to do now
- Update the plugin to a release newer than 3.0.1.
- Review the other plugins and themes on the site. The record says impact depends on a usable gadget chain elsewhere.
- Remove plugins you no longer use, since each one adds possible chains.
- Look up CVE-2024-13556 on its Gold page to see the current details and any fix information.
- Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.
Why it matters
The record lists CWE-502 for deserialization and CWE-862 for missing authorization. The deserialization happens on data from a file export, and no authorization check protects it. Attack complexity is high because the outcome relies on another plugin or theme with a usable chain.
That dependence is why this kind of bug is hard to score. On a lean site it may do nothing, and on a site with many plugins it may lead to file deletion or code execution.
This CVE is a PHP object injection flaw (CWE-502, CWE-862, Deserialization of Untrusted Data and Missing Authorization). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
PHP object injection comes from deserializing data that an outsider controls. When the application rebuilds an object from that data, it can trigger code in the class that was never meant to run for this input.
What happens next depends on what other code is installed. The advisory text says no known gadget chain exists in the vulnerable software itself, so on its own the impact is limited. If another plugin or theme on the same site supplies a usable chain, the result can range from deleting files to data theft to code execution. That makes your full plugin list part of the risk, not just the one component named here.
Quick check
Is there a known chain in this plugin?
The record says no known chain is present in the plugin itself.
Why high complexity?
The attacker also needs another component with a chain, which the attacker does not control.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
