Paytium CVE-2026-114196

The flaw is PHP Object Injection via untrusted-data deserialization (CWE-502) in Paytium versions from an unspecified start through 5.0.5; the specific endpoint, parameter, and whether a special plugin configuration or payment-gateway mode is required are not described in the available sources. The supplied CVSS vector is AV:N/AC:L/PR:N/UI:N, implying remote, unauthenticated exploitation against affected installs with no user interaction. Real-world impact is limited by whether an exploitable POP gadget chain exists in the running code - object injection alone does not guarantee code execution or data compromise - and by the plugin actually being installed and the vulnerable code path being reachable; these limiting factors are not confirmed in the sources.

Signals are partially aligned but incomplete. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) describes a remotely reachable, low-complexity, unauthenticated flaw with full impact, and the vuln.today decision label is 'act_now', which argues for prompt remediation. However, the only substantive signal driving urgency is the Patchstack advisory and the CVSS score itself: no EPSS probability, no CISA KEV listing, and no confirmed public exploit code are present in the input, so there is no independent evidence of real-world exploitation volume. CWE-502 PHP Object Injection is only as impactful as the gadget (POP) chain reachable in the plugin or its loaded dependencies; the sources do not state which gadget chain, if any, yields code execution or data compromise, so the C:H/I:H/A:H rating should be treated as the reporter's worst-case assessment rather than demonstrated impact. Net: treat as a genuine priority to patch given act_now plus a Critical unauthenticated vector on an internet-facing WordPress plugin, but recognize the elevated severity rests largely on the CVSS vector and a single reporter, not on exploitation telemetry (EPSS/KEV absent).

A remote attacker sends a crafted request to a vulnerable Paytium endpoint (e.g. a payment-handling or callback parameter) containing a serialized PHP object, which the plugin deserializes without validation. If a usable gadget chain is present in the plugin, WordPress core, or other active code, object instantiation can be abused to manipulate files, data, or execution flow. No public, verified working exploit code is identified in the provided sources; the single reference is a Patchstack vulnerability advisory.