PHP Object Injection

Everything Threat Times has reported about PHP Object Injection: 14 stories, newest first. Part of our Vulnerabilities coverage.

Vulnerabilities

Critical Unauthenticated PHP Injection Flaw Found in Payever WooCommerce Plugin

Threat TimesOct 10, 2026

The NVD rates CVE-2026-42716 as critical with a 9.8 score, affecting Payever WooCommerce Gateway versions up to 4.8.2 through unauthenticated object injection.

Vulnerabilities

Critical PHP Object Injection Flaw Found in Dynamic User Directory Plugin

Threat TimesOct 10, 2026

A CVSS 9.8 vulnerability in the Dynamic User Directory plugin allows remote attackers to inject PHP objects in versions up to 2.4.

Vulnerabilities

Unauthenticated PHP Object Injection Flaw in Booster for WooCommerce Rated Critical

Threat TimesOct 10, 2026

A critical vulnerability in Booster for WooCommerce allows unauthenticated attackers to inject PHP objects, earning a CVSS score of 9.8.

Vulnerabilities

Unauthenticated PHP Object Injection Flaw Found in CleanSkin Plugin

Threat TimesOct 10, 2026

A critical vulnerability in the CleanSkin WordPress plugin allows attackers to inject malicious code without logging in.

Vulnerabilities

Critical Unauthenticated PHP Object Injection Found in Stargaze WordPress Theme

Threat TimesOct 10, 2026

The National Vulnerability Database lists CVE-2026-62051 as a critical flaw in Stargaze versions up to 1.10, allowing remote code execution.

Vulnerabilities

Critical Unauthenticated PHP Object Injection Found in Splendour WordPress Theme

Threat TimesOct 10, 2026

The National Vulnerability Database lists CVE-2026-62050 as a critical flaw allowing remote code execution in Splendour versions up to 1.23.

Vulnerabilities

Critical Unauthenticated PHP Object Injection Flaw Found in Tipsy Theme

Threat TimesOct 10, 2026

The National Vulnerability Database rates CVE-2026-62052 as critical for Tipsy versions 1.6 and earlier due to unauthenticated injection risks.

Vulnerabilities

Critical PHP Object Injection Flaw Found in Wine House WordPress Theme

Threat TimesOct 10, 2026

Unauthenticated attackers can exploit CVE-2026-62053 in Wine House versions up to 3.20 to achieve critical remote code execution.

Vulnerabilities

Critical Unauthenticated PHP Object Injection Found in Yacht Rental WordPress Theme

Threat TimesOct 10, 2026

The National Vulnerability Database lists CVE-2026-62054 as a critical flaw allowing remote code execution in Yacht Rental versions up to 2.6.

Vulnerabilities

Unauthenticated PHP Object Injection Flaw Rated Critical in Kalles CMS

Threat TimesOct 10, 2026

A critical vulnerability in Kalles CMS versions up to 1.1.7.1 allows unauthenticated attackers to inject PHP objects, posing significant security risks.

Vulnerabilities

Critical Unauthenticated PHP Object Injection Flaw Found in Avala Plugin

Threat TimesOct 10, 2026

The National Vulnerability Database lists CVE-2026-62077 as a critical severity issue affecting BoldThemes Avala versions up to 1.1.4.

Vulnerabilities

Critical Unauthenticated PHP Object Injection Found in Juno WordPress Theme

Threat TimesOct 10, 2026

A severe vulnerability in the Juno WordPress theme allows attackers to execute code without authentication, affecting versions up to 2.25.

Vulnerabilities

Equadio WordPress Theme Faces Critical Unauthenticated PHP Object Injection Flaw

Threat TimesOct 10, 2026

The National Vulnerability Database rates CVE-2026-62087 as critical, affecting Equadio versions up to 1.1.4 with a CVSS score of 9.8.

Vulnerabilities

Critical Unauthenticated PHP Object Injection Flaw Found in WineShop <= 3.20

Threat TimesOct 10, 2026

The NVD rates CVE-2026-62090 as critical, affecting WineShop versions up to 3.20 with a CVSS score of 9.8 due to unauthenticated PHP object injection vulnerabilities.