CVE-2023-27372-SPIP-4.2.1-Unauthenticated-RCE-PoC

CVE-2023-27372 — SPIP Уязвимость удаленного выполнения кода без аутентификации в SPIP до версии 4.2.1. Параметр oubli в форме сброса пароля уязвим для внедрения PHP-объектов из-за некорректной десериализации. Сформированная сериализованная полезная нагрузка выполняется на стороне сервера от имени...

100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS

On August 23rd, 2026, Wordfence Argus, our AI research agent specializing in complex vulnerability chains, discovered a PHP Object Injection vulnerability in Tutor LMS, a WordPress e-learning plugin active on more than 100,000 websites. This vulnerability allows any authenticated attacker with...

WordPress ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin <= 6.5.5 - Authenticated (Author+) PHP Object Injection vulnerability

Authenticated Author+ PHP Object Injection vulnerability discovered by Josh Bolding in WordPress Plugin ShortPixel Image Optimizer versions = 6.5.5...

CVE-2026-46275

CVE-2026-46725 — RCE расширения TYPO3 ceselector Внедрение PHP-объектов через обход cookieunserialize → Удаленное выполнение кода 📋 Содержание Об уязвимости Технические детали Требования Установка Использование Примеры Формат вывода Как это работает...

cve-2026-39440-funnelforms-fix

CVE-2026-39440 FunnelForms 수정 취약한 FunnelForms Pro ≤ 3.8.1 의 Demo Import 핸들러를 차단하여 원격 코드 실행CVE-2026-39440, CVSS 9.9 위험을 완화하는 드롭인 WordPress 플러그인입니다. 취약점 정보 필드| 값 ---|--- CVE ID| CVE-2026-39440 CVSS 점수| 9.9 치명적 영향 범위| FunnelForms Pro ≤ 3.8.1 권한 수준| 낮음 구독자 수준 유형| 코드 주입 → 원격 코드 포함 → RCE 패치 여부| 공식 공급업체...

CVE-2024-56059

CVE-2024-56059 Partners = 0.2.0 - PHP Object Injection без аутентификации Описание Плагин Partners для WordPress уязвим к PHP Object Injection в версиях до 0.2.0 включительно из-за десериализации недоверенных входных данных. Это позволяет неаутентифицированным атакующим внедрить PHP-объект. В...

CVE-2023-46615

CVE-2023-46615 KD Coming Soon = 1.7 - Неаутентифицированная инъекция PHP-объектов через cetitle Описание: Плагин KD Coming Soon для WordPress уязвим к инъекции PHP-объектов во всех версиях до 1.7 включительно через десериализацию недоверенного входного параметра cetitle в уязвимой функции...

vulnerable-bsr-lab-CVE-2023-6933

CVE-2023-6933 脆弱性ラボ 概要 このラボ環境は、Better Search Replace WordPress プラグイン（バージョン ≤1.4.4）における重大な PHP オブジェクトインジェクション脆弱性 CVE-2023-6933 を実演します。 脆弱性の詳細 CVE ID : CVE-2023-6933 CVSS スコア : 9.8（緊急） 影響を受けるプラグイン : Better Search Replace ≤1.4.4 脆弱性タイプ : 非シリアル化されたユーザー入力による PHP オブジェクトインジェクション 攻撃ベクトル : AJAX エンドポイント...

CVE-2026-91939

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowedclasses restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads ...

CVE-2026-91939 Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowedclasses restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads ...

CVE-2026-91939

Cotonti 1.0.0 Comments plugin passes the ci GET parameter directly to unserialize() without an allowed_classes restriction. This allows unauthenticated attackers to inject arbitrary PHP objects via crafted serialized payloads, triggering gadget chains that can lead to database manipulation or rem...

CVE-2026-91939 Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowedclasses restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads ...

EUVD-2026-80000

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowedclasses restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads ...

CVE-2026-49400

October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowedclasses restriction. Any code path that could...

EUVD-2026-77682

October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowedclasses restriction. Any code path that could...

CVE-2026-49400 October CMS: PHP Object Injection via Backend Widget Session Storage

October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowedclasses restriction. Any code path that could...

CVE-2026-49400

October CMS (System module) prior to v3.7.17 and v4.2.21 is affected by a PHP object injection vulnerability in the backend SessionMaker trait, which stored widget session state as base64(serialize(...)) and deserialized it with unserialize() without an allowed_classes restriction. Exploitation r...

October CMS: PHP Object Injection via Backend Widget Session Storage

The backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowedclasses restriction. Any code path that could write to a widget. session key with attacker-controlled bytes could trigger PHP object injection the next time the widg...

Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin

On August 21 and August 22, 2026, Wordfence Argus, created by the Wordfence Threat Intelligence team, identified two independent critical vulnerability chains in The Events Calendar, a WordPress plugin active on more than 600,000 websites. Both chains begin in the plugin's widget-rendering pipeli...

WordPress wpstorecart plugin <= 5.0.7 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by reconnaissance in WordPress Plugin WPStoreCart versions = 5.0.7...