EUVD-2026-112119
GHSA-952j-59wf-62xp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privilege WordPress account
-
DeliverySubmit crafted serialized payload to plugin input
-
ExploitTrigger unsafe deserialization (PHP object injection)
-
ExecutionInstantiate malicious objects via gadget chain
-
ImpactCompromise site confidentiality, integrity and availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated high-privilege (administrator-level, per CVSS PR:H) WordPress user who can reach the plugin input that performs unsafe deserialization; it affects Filter Everything - WordPress & WooCommerce Filters versions up to and including 1.9.7. The limiting factors are significant: the attacker must already possess privileged credentials or an active privileged session, and meaningful impact depends on a usable PHP object-injection (POP) gadget chain being present - a factor the available sources do not confirm. The specific vulnerable parameter or feature that triggers the deserialization is not described in the available sources. |
| Impact | The input provides a CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) and a CWE-502 PHP Object Injection classification reported by Patchstack. The network attack vector with low complexity and no user interaction raises the apparent reach, but PR:H is the decisive limiter: exploitation requires an already high-privilege (effectively administrator-level) authenticated WordPress account, which substantially narrows realistic abuse to insiders or attackers who have already compromised a privileged session. No EPSS probability is supplied, the vulnerability is NOT in CISA KEV, and no verified exploit code or SSVC automatable/technical-impact breakdown is provided - so there is no signal of active or widespread exploitation. The vuln.today decision label is 'this_week', indicating prioritized but non-emergency remediation. Object injection impact is also gadget-dependent: full confidentiality/integrity/availability compromise assumes a usable POP gadget chain in the plugin or loaded code, which the available sources do not confirm. Net: a genuinely serious flaw worth near-term patching, but the high-privilege prerequisite makes it a targeted/post-auth risk rather than a mass-exploitable critical. |
| Exploit ScenarioDerived | An attacker holding (or having hijacked) an administrator-level WordPress account submits crafted serialized data to a plugin input that is unsafely deserialized, instantiating attacker-controlled PHP objects. If a suitable gadget chain is present, this is leveraged toward code execution or data manipulation on the site. No verified public exploit code was identified in the available sources, and the exact triggering endpoint is not described. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
PHP object injection via unsafe deserialization affects the WordPress/WooCommerce plugin Filter Everything through version 1.9.7, allowing an attacker with administrator-level privileges (CVSS PR:H) to deserialize untrusted data and potentially achieve high impact on confidentiality, integrity and availability. The flaw is network-reachable with low attack complexity and no user interaction, but meaningful exploitation depends on a usable POP gadget chain being present in the loaded code base, which the available sources do not confirm. No public exploit code or CISA KEV entry is identified at time of analysis; the vulnerability was reported by Patchstack and the affected parameter or feature that triggers deserialization is not described in the available sources.
RemediationAI
No vendor-released patch version is identified in the available data, so confirm the current fixed release with the vendor before upgrading; check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/filter-everything/vulnerability/wordpress-filter-everything-wordpress-woocommerce-filters-plugin-1-9-7-php-object-injection-vulnerability) for the corrected version and apply it as soon as it is published. Because exploitation requires PR:H administrator-level access, the most effective interim control is reducing who holds that access: audit and trim administrator accounts, enforce strong authentication and unique credentials for privileged users, and remove the plugin entirely if filtering is not in active use (removal eliminates the attack surface but loses filtering functionality). Restrict wp-admin and plugin AJAX endpoints by IP or via a WAF rule set limited to trusted administrators, accepting the operational cost that legitimate administrators working off-network will be blocked. Note that the trigger parameter is not described in the available sources, so targeted virtual patching must rely on generic PHP object injection signatures rather than a specific endpoint.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-502 (Deserialization of Untrusted Data) in a PHP WordPress plugin means attacker-influenced data reaches an unserialize() style sink, letting crafted serialized payloads instantiate arbitrary objects. In PHP the practical impact is PHP Object Injection: the attacker can set properties on instantiated classes and, if a property-oriented programming (POP) gadget chain exists across the plugin, theme or other loaded plugins, chain magic methods (__wakeup, __destruct, __toString) into file operations, SQL execution or code execution. The CPE identifies the target as the stepasyuk Filter Everything - WordPress & WooCommerce Filters plugin, an AJAX/filtering component for WooCommerce product and WordPress post filtering, installed as a standard WP plugin and therefore reachable over HTTP by any user able to send requests to the site. The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H describes severity: low complexity and no user interaction, but a privileged (administrator-level) actor is required, so the bug is primarily a post-authentication or privilege-abuse path rather than a pre-auth entry point. The specific serialization sink and the affected parameter are not described in the available sources, and the presence of a working gadget chain in a default installation is unverified.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable deserialization needing administrator privileges gives AV:N/AC:L/PR:H/UI:N; object injection can yield full code-level compromise, so C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything - WordPress & WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything - WordPress & WooCommerce Filters: from n/a through 1.9.7.
Executive ViewAI
A high-severity PHP object injection vulnerability (CVE-2026-116390) affects the Filter Everything plugin for WordPress/WooCommerce, through version 1.9.7. The flaw requires administrator-level privileges to exploit, so external attackers would first need to compromise an admin account. While no public exploit or active exploitation is currently identified, a successful attack could severely impact data confidentiality, integrity, and availability, making it critical for leadership to prioritize patching or mitigation to protect e-commerce operations and customer trust.
No vendor-released patch identified at time of analysis; interim mitigations include restricting administrator access, enforcing least privilege, monitoring for anomalous admin behavior, and deploying WAF rules to detect and block deserialization attacks.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB