EUVD-2026-15724
GHSA-p9qh-h9cj-hc7v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in wpdive Nexa Blocks nexa-blocks allows Object Injection.This issue affects Nexa Blocks: from n/a through <= 1.1.1.
AnalysisAI
A PHP Object Injection vulnerability exists in the Nexa Blocks WordPress plugin (versions up to and including 1.1.1) due to unsafe deserialization of untrusted data, allowing attackers to instantiate arbitrary PHP objects and potentially achieve remote code execution. The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) and affects all installations of the affected plugin versions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Remote unauthenticated attacker can exploit this vulnerability in WordPress sites with the wpdive Nexa Blocks plugin version <= 1.1.1 installed and activated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Although a CVSS score is not yet assigned and EPSS data is unavailable, the underlying vulnerability class (CWE-502, object injection) is inherently high-risk in PHP environments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious serialized PHP object payload containing a gadget chain derived from WordPress core or installed plugin classes. The attacker submits this payload via a POST request, cookie, or other untrusted data channel that reaches an unprotected deserialization function in the Nexa Blocks plugin. … |
| Remediation | Immediately update the Nexa Blocks plugin to a patched version beyond 1.1.1 if available from the plugin developer or WordPress.org repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all affected systems and apply vendor patches immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today