EUVD-2026-102053
GHSA-85vx-7jh4-67mh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach plugin deserialization endpoint
-
DeliveryDeliver crafted serialized PHP object
-
ExploitTrigger unsafe unserialize()
-
ExecutionInstantiate POP gadget chain
-
ImpactExecute attacker-controlled actions on site
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the deserialization logic in the Link Whisper Free plugin (versions up to and including 0.9.7) where untrusted input is passed to PHP unserialize(). Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required to reach the sink. The decisive limiting factor is that PHP Object Injection yields real impact only when a usable POP gadget chain exists in the plugin, its libraries, or WordPress core/other active plugins; absent such a chain the object injection may be inert. Exploitation is further bounded to sites running the vulnerable Link Whisper Free plugin at version 0.9.7 or earlier. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) portrays this as a trivially exploitable, remote, unauthenticated flaw with full confidentiality, integrity, and availability impact. However, this is a PHP Object Injection / insecure deserialization issue (CWE-502) in a WordPress plugin, and in practice such vulnerabilities almost always require a usable POP (property-oriented programming) gadget chain in the plugin, its dependencies, or WordPress core to escalate object injection into meaningful impact such as RCE, SQL injection, or file operations. No such chain is referenced in the single Patchstack advisory, so the real-world attack complexity is likely higher than AC:L suggests. No EPSS score, CISA KEV listing, or public POC is present in the provided data, meaning there is no evidence of active exploitation or weaponization - the 9.8 is a theoretical worst-case rating from Patchstack, not a validated exploitation signal. Net: treat as a genuinely serious patch-priority item for anyone running the affected plugin (object injection with no required auth is dangerous), but the gap between the 9.8 CVSS and the absence of EPSS/KEV/POC data means this is not confirmed as being under widespread exploitation. The AC:L vs. the typical gadget-chain dependency of object-injection flaws is the key conflict - verify whether an exploitable chain exists before treating impact as fully confirmed RCE. |
| Exploit ScenarioDerived | An unauthenticated remote attacker submits a crafted request to the Link Whisper Free plugin containing a maliciously serialized PHP object, which the plugin deserializes without validation. If a suitable POP gadget chain is reachable in the plugin or WordPress environment, the injected object is instantiated and abused to perform actions such as code execution, data tampering, or file manipulation on the WordPress site. No public exploit code is identified in the provided data, and successful impact depends on the availability of a usable gadget chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
PHP object injection in Link Whisper Free (a WordPress plugin) through version 0.9.7 allows unauthenticated remote attackers to pass untrusted data into PHP's unserialize() and instantiate arbitrary objects, per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) supplied with the advisory. Our independent assessment keeps the network-reachable, unauthenticated, no-interaction prerequisites but raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), because CWE-502 only translates into full confidentiality, integrity, and availability loss when a usable POP gadget chain exists somewhere in the plugin, its bundled libraries, or other code loaded on the target site; absent such a chain the injected object may be inert. No public exploit identified at time of analysis, there is no CISA KEV listing, and no EPSS score was provided, so exposure today is limited to sites running the vulnerable plugin version that also happen to carry a viable gadget chain.
RemediationAI
No vendor-released patch was identified in the provided data, so there is no exact fixed version to cite; administrators should treat every release up to and including 0.9.7 as vulnerable and monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/link-whisper/vulnerability/wordpress-link-whisper-free-plugin-0-9-7-php-object-injection-vulnerability?_s_id=cve) and the Link Whisper vendor channels for the patched release, then upgrade immediately. The most reliable mitigation available now is to deactivate and, if the site does not depend on it, remove the Link Whisper Free plugin entirely - the trade-off is loss of internal-link automation features, which is a small price for closing an unauthenticated object-injection sink. If the plugin must stay online, treat it as an exposed attack surface and compensate: place a WAF or reverse proxy rule in front of the site that rejects POST/GET bodies containing serialized-object markers such as 'O:' followed by a digit and class-name patterns like '__PHP_Incomplete_Class' or obvious gadget-class names, accepting that this is heuristic, prone to false positives on legitimate serialized data, and can be bypassed by encoding tricks; restrict access to any plugin REST or AJAX endpoint that reaches the deserialization path using IP allowlisting or authentication at the edge, which may break the plugin's normal editor-side functionality; and run the site with a minimal set of active plugins and themes to shrink the available POP gadget chain surface, since each additional component increases the chance that a usable chain exists. Because the vector is PR:N/UI:N, do not rely on 'only logged-in users can trigger it' reasoning, and enable request logging plus file-integrity monitoring on the plugin directory to detect exploitation attempts in the absence of a patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-502, Deserialization of Untrusted Data, in the PHP/WordPress context: the plugin hands attacker-controllable input to unserialize() without restricting allowed classes or validating the payload. PHP's unserialize() reconstructs objects from an attacker-supplied string and automatically invokes magic methods such as __wakeup(), __destruct(), __toString(), and __call() during and after reconstruction. Attackers do not need to control the class they instantiate directly; they chain together existing classes already loaded on the site (a POP, or property-oriented programming, gadget chain) so that the sequence of magic-method calls ends in a dangerous sink such as file write, file deletion, SQL execution, or arbitrary method invocation. This is why impact is conditional: the sink is only as powerful as the gadget chains reachable in the plugin itself, in its Composer/library dependencies, in WordPress core, and in every other active plugin and theme - the notoriously heterogeneous, user-controlled composition of a typical WordPress install. Because the vector carries PR:N and UI:N, no authentication or user interaction is needed to reach the deserialization entry point, but the practical ceiling of the vulnerability is bound by gadget availability, which is what justifies the AC:H assessment rather than the vendor's AC:L. No CPE inventory was supplied with this report, so affected-product identification relies on the named WordPress plugin slug (link-whisper) and version ceiling of 0.9.7 stated in the description and in the Patchstack advisory.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network, unauthenticated reachability (AV:N/PR:N) but AC:H because object injection requires a usable POP gadget chain; full impact assumed if a chain enables code execution.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
Executive ViewAI
Link Whisper Free, a WordPress plugin, versions up to 0.9.7, contains a critical PHP object injection vulnerability that could allow unauthenticated attackers to achieve full site compromise if a suitable gadget chain exists. Although no public exploit has been identified and no vendor-released patch is available, organizations running this plugin on their WordPress sites should act immediately to mitigate risk. The vulnerability's actual exploitability depends on the presence of a usable gadget chain, which may not be universal, but the potential impact includes data theft, defacement, or complete site takeover.
Disable or remove the Link Whisper Free plugin if not essential. If it must remain, deploy a WAF with virtual patching to block PHP object injection, monitor for suspicious serialized data, restrict access to plugin endpoints, and consider using a security plugin that can block unserialize() or restrict object instantiation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB