GS Pins CVE-2026-110370

Exploitation requires the attacker to hold a valid authenticated WordPress account at low privilege (CVSS PR:L - e.g. Subscriber/Contributor level) on a site running GS Pins for Pinterest (gs-pinterest-portfolio) version 1.9.2 or earlier. The attacker must reach the plugin code path that passes attacker-controlled input to PHP unserialize(); successful impact (code execution vs. limited object injection) further depends on the availability of a usable POP gadget chain in the plugin, WordPress core, or another installed component. No user interaction is required (UI:N) and the attack is over the network (AV:N), but the authentication requirement and gadget-chain dependency are the primary factors limiting real-world exploitation.

This is a CWE-502 PHP Object Injection flaw with a vendor (Patchstack) CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8, High). The network attack vector, low complexity, and no required user interaction make exploitation straightforward, and the full H/H/H impact reflects the typical outcome of successful PHP object injection - potential remote code execution, data theft, or site takeover when a usable POP gadget chain is present. The key limiting signal is PR:L: exploitation requires at least low-privileged authentication (commonly a Subscriber/Contributor-level WordPress account), so this is not a fully unauthenticated bug. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no evidence of active exploitation or weaponization at this time. Net assessment: a genuinely high-severity, easy-to-exploit vulnerability for any attacker who can obtain even a low-level account, but real-world mass-exploitation risk is tempered by the authentication requirement, the narrow deployment footprint of this specific plugin, and the dependency on a reachable gadget chain (the CVSS H/H/H assumes a worst-case gadget that may not exist in a default install).

An attacker who holds or registers a low-privileged account on a WordPress site running GS Pins for Pinterest 1.9.2 or earlier submits a crafted serialized payload to a vulnerable plugin input that is passed to unserialize(). If a suitable PHP property-oriented programming (gadget) chain is available in the plugin, WordPress core, or another installed plugin/theme, the deserialization triggers object injection leading to data compromise or remote code execution. No public exploit code was identified in the provided data.