EUVD-2026-15602
GHSA-mc4p-6c88-mv7c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in NooTheme Visionary Core noo-visionary-core allows Object Injection.This issue affects Visionary Core: from n/a through <= 1.4.9.
AnalysisAI
A PHP Object Injection vulnerability exists in NooTheme Visionary Core plugin versions up to and including 1.4.9, stemming from unsafe deserialization of untrusted data. An attacker can inject malicious serialized objects to achieve arbitrary code execution or other critical impacts depending on available magic methods in the WordPress environment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires authenticated user access to NooTheme Visionary Core plugin version 1.4.9 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | While no CVSS vector or EPSS score is provided, the underlying CWE-502 designation indicates high severity in standard vulnerability frameworks. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker could craft a malicious HTTP request containing a specially formatted serialized PHP object targeting a vulnerable endpoint in the Visionary Core plugin (for example, during plugin initialization, form processing, or AJAX handlers). When the plugin deserializes this payload without validation, the attacker's object instantiates, triggering magic methods that execute arbitrary PHP code with the privileges of the WordPress application—typically resulting in remote code execution, data exfiltration, or further system compromise. … |
| Remediation | Update NooTheme Visionary Core to a patched version greater than 1.4.9 immediately if available from the vendor; check the official NooTheme website or WordPress plugin repository for the latest release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 7 days: Identify all affected systems and apply vendor patches promptly. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today