What is the CVSS score of CVE-2026-12115?

CVE-2026-12115 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Counter Box WordPress CVE-2026-12115

EUVD-2026-37585 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Wordfence

PHP Deserialization WordPress Information Disclosure Counter Box Add Countdowns Timers Dynamic Counters To Wordpress

6.6

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.6 MEDIUM

PR:H reflects mandatory admin credentials; AC:H captures the environmental POP chain dependency; C/I/A:H reflect ceiling impact when chain is present.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 10:18 vuln.today

CVE Published

Jun 17, 2026 - 09:30 cve.org

MEDIUM 6.6

DescriptionCVE.org

The Counter Box - Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Deserialization is triggered automatically upon the post-import redirect that renders the list table, and again when any item is opened for editing, requiring no additional navigation beyond the import action itself.

AnalysisAI

PHP Object Injection in the Counter Box WordPress plugin (all versions through 2.0.13) allows authenticated administrators to deserialize attacker-controlled input via the plugin's import functionality, with deserialization triggered automatically on the post-import redirect and again when any imported item is opened for editing. The vulnerability carries no standalone impact - exploitation is entirely contingent on a Property-Oriented Programming (POP) chain being present in a separately installed plugin or theme, at which point an attacker could achieve arbitrary file deletion, sensitive data retrieval, or remote code execution. No public exploit is identified at time of analysis, and the CVSS AC:H and PR:H ratings reflect both the administrative access requirement and the environmental dependency on co-installed POP chain software.

Technical ContextAI

CWE-502 (Deserialization of Untrusted Data) is the root cause class. The vulnerability originates in multiple administrative class files within the plugin: DBManager.php (line 168), ImporterExporter.php (line 101), ListTable.php (line 53), and Settings.php (line 155) - all identified via Wordfence's source-linked disclosure. PHP's native unserialize() function, when passed attacker-supplied data from an import file, reconstructs arbitrary PHP objects. The affected CPE is cpe:2.3:a:wpcalc:counter_box_-_add_countdowns,_timers_&_dynamic_counters_to_wordpress:*:*:*:*:*:*:*:* covering all versions. The trigger mechanism is notably passive from an attacker perspective: deserialization fires automatically during the post-import redirect that renders the list table view, and again whenever any record is opened for editing - no additional manual steps beyond the import action are required once the malicious payload is uploaded.

RemediationAI

An upstream fix has been committed to the plugin's WordPress SVN repository (changeset 3570995 referenced at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3570995%40counter-box&new=3570995%40counter-box); however, the exact released patched version number is not independently confirmed from the available input data - update to the latest available version from the WordPress Plugin Repository and verify it supersedes 2.0.13. As a compensating control, restrict the WordPress administrator role to the minimum required set of trusted users, since exploitation requires admin-level access; reducing the attack surface at the authentication layer directly limits who can trigger the import functionality. Additionally, audit co-installed plugins and themes for known POP chain gadgets - tools such as PHPGGC can identify common chains - and remove or replace any that introduce POP chain risk, as the vulnerability has no exploitable impact without one. Note that disabling the import/export feature entirely, if operationally feasible, removes the deserialization trigger without requiring a patch. Full advisory details are available at https://www.wordfence.com/threat-intel/vulnerabilities/id/3498c871-9404-4d12-9609-16fecf218b30.