PT-2026-91835

The backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowed classes restriction. Any code path that could write to a widget. session key with attacker-controlled bytes could trigger PHP object injection the next time the...

CVE-2026-82222-PoC

CVE-2026-82222 — GiveWP Unauthenticated PHP Object Injection → RCE Lab + proof-of-concept for CVE-2026-82222 : unauthenticated PHP object injection leading to remote code execution in the GiveWP WordPress donation plugin = 4.16.7.1 patched in 4.16.7.2...

CVE-2026-78175

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...

EUVD-2026-76834

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...

CVE-2026-78175 Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...

CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the issafewidgetinstance function. This is due to insufficient protection in issafewidgetinstance, which can be bypassed because PHP fires magic methods during its...

CVE-2026-78175

Tutor LMS (WordPress eLearning plugin) is vulnerable to PHP Object Injection in versions up to and including 4.0.7 via the withdraw_method_field parameter of the tutor_save_withdraw_account AJAX handler. The handler relies solely on a nonce without capability checks, and a flaw in how esc_sql() h...

CVE-2026-82845

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...

CVE-2026-84099

CVE-2026-84099 affects the wpstorecart WordPress plugin (IDB Ecommerce, wpStoreCart 5) in versions through 5.0.7 . The root cause is that the plugin fails to prevent direct, unauthenticated access to a bundled add-on — specifically the wpsc-membership-pro component in paypal.php — which deseriali...

CVE-2026-84099 IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...

CVE-2026-82845

CVE-2026-82845 affects the Masteriyo LMS WordPress plugin in versions before 3.4.1 . The root cause is deserialization of untrusted data : user-supplied values stored as metadata are deserialized without validation when read back. Authenticated users with a Subscriber (or higher) role can inject ...

PT-2026-90570

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...

WordPress The Events Calendar plugin <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution vulnerability

Unauthenticated PHP Object Injection to Remote Code Execution vulnerability discovered by Chloe Chamberland, Wordfence Argus in WordPress Plugin The Events Calendar versions = 6.17.4...

CVE-2026-62107

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-62103

Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...

CVE-2026-62105

Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...

EUVD-2026-76212

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-62107 WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-62107

Masteriyo – LMS is a WordPress LMS plugin affected by an unauthenticated PHP Object Injection vulnerability in versions ≤ 3.4.0 . The flaw allows an attacker to inject a malicious serialized PHP object, potentially leading to full compromise of the site. The Patchstack CVSS 3.1 score is 8.8 (HIGH...

CVE-2026-62105

CVE-2026-62105 affects the ThemeREX Addons WordPress plugin in versions prior to 2.45.0 , introducing an unauthenticated PHP Object Injection vulnerability. The flaw is exploitable over the network with low complexity, requires no privileges or user interaction, and is scored CVSS 3.1: 9.8 (Criti...