What is the CVSS score of CVE-2026-27410?

CVE-2026-27410 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-27410?

Yes, a patch is available for CVE-2026-27410. Update the affected software to the latest version immediately.

Slimstat Analytics CVE-2026-27410

Q: Which versions of Slimstat Analytics are affected by CVE-2026-27410?

Unauthenticated deserialization of untrusted data in the Slimstat Analytics WordPress plugin (versions prior to 5.4.0) allows remote attackers to exploit PHP object injection without authentication.. A patch is available.

EUVD-2026-37670 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

WordPress Deserialization Slimstat Analytics Wordpress Plugin Veronalabs

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable unauthenticated deserialization (AV:N/PR:N); AC:H reflects gadget-chain dependency; S:C and L/L/L impact consistent with PHP object injection without confirmed RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jun 17, 2026 - 13:01 EUVD

Analysis Generated

Jun 17, 2026 - 12:54 vuln.today

DescriptionCVE.org

Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions.

AnalysisAI

Unauthenticated deserialization of untrusted data in the Slimstat Analytics WordPress plugin (versions prior to 5.4.0) allows remote attackers to exploit PHP object injection without authentication. The CVSS vector indicates high attack complexity (AC:H) and scope change (S:C), meaning successful exploitation can affect components beyond the plugin itself - potentially the broader WordPress environment or server. No public exploit identified at time of analysis, and the fix version is confirmed as 5.4.0 per Patchstack reporting.

Technical ContextAI

Slimstat Analytics is a visitor statistics and analytics plugin for WordPress, developed by veronalabs (CPE: cpe:2.3:a:veronalabs:slimstat_analytics:*:*:*:*:*:*:*:*). CWE-502 (Deserialization of Untrusted Data) describes a class of vulnerability where user-controlled data is passed to PHP's unserialize() or an equivalent deserialization function without validation. In PHP, this enables PHP Object Injection: if the application or any loaded library exposes 'magic method' gadget chains (such as __wakeup, __destruct, or __toString), an attacker can craft a serialized payload that invokes arbitrary code paths or filesystem operations when deserialized. The CVSS scope-changed (S:C) metric indicates the deserialization boundary crosses into other WordPress components, plugins, or the PHP runtime environment itself.

RemediationAI

Vendor-released patch: 5.4.0. Update the Slimstat Analytics plugin to version 5.4.0 or later immediately via the WordPress admin dashboard or WP-CLI (wp plugin update wp-slimstat). If immediate patching is not feasible, consider deactivating the plugin entirely to eliminate the attack surface - leaving it active but unpatched is not a safe workaround, as the vulnerability is reachable without authentication. WordPress site owners running managed hosting should verify whether their platform auto-applies plugin updates. Review the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-slimstat/vulnerability/wordpress-slimstat-analytics-plugin-5-4-0-deserialization-of-untrusted-data-vulnerability?_s_id=cve for additional guidance. A WAF rule targeting serialized PHP payloads in HTTP parameters can provide a compensating control but should not substitute for patching.