What is the CVSS score of CVE-2026-32513?

CVE-2026-32513 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Js Archive List are affected by CVE-2026-32513?

CVE-2026-32513 presents significant security risk, a insecure deserialization vulnerability rated CVSS 8.8.

How to fix or mitigate CVE-2026-32513?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Restrict deserialization to trusted data sources and implement integrity checks.

Js Archive List CVE-2026-32513

EUVD-2026-15870 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-g2rf-phpj-m3m9

Deserialization Js Archive List

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15870

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows Object Injection.This issue affects JS Archive List: from n/a through <= 6.1.7.

AnalysisAI

A deserialization of untrusted data vulnerability in the JS Archive List jQuery widget (jquery-archive-list-widget) versions up to 6.1.7 allows remote attackers to inject malicious objects and achieve code execution or information disclosure. The vulnerability affects WordPress installations using the vulnerable plugin versions, and exploitation requires sending crafted serialized PHP objects to the affected endpoint. No CVSS vector or EPSS score has been assigned, and KEV status is unknown, though the vulnerability was reported by Patchstack security researchers.

Technical ContextAI

The JS Archive List plugin for WordPress, maintained by Miguel Useche and identified by CPE cpe:2.3:a:miguel_useche:js_archive_list:*:*:*:*:*:*:*:*, implements insecure deserialization of untrusted data, which is classified under CWE-502 (Deserialization of Untrusted Data). This class of vulnerability occurs when an application deserializes user-controlled input without proper validation or type checking, allowing attackers to instantiate arbitrary PHP objects. In WordPress plugin contexts, this typically occurs when unserializing GET/POST parameters or options stored in the database without sanitization. The jquery-archive-list-widget uses jQuery for frontend functionality but the vulnerability resides in backend PHP deserialization logic, where an attacker can craft a malicious serialized object that, when unserialized, triggers magic methods (__wakeup, __destruct, __toString) in the PHP object graph to perform unintended operations.

RemediationAI

Upgrade JS Archive List (jquery-archive-list-widget) to a patched version released after 6.1.7 as soon as the vendor releases a fix (check the Patchstack database and official WordPress plugin repository for the latest secure version). Until a patch is available, consider disabling the jquery-archive-list-widget plugin entirely if it is not critical for operations, or restrict access to the WordPress administrative dashboard and frontend forms that use the plugin via IP whitelisting, WAF rules, or authentication controls. Implement input validation and sanitization at the application level by reviewing any custom code that calls unserialize() on user input and replacing it with safer alternatives such as json_decode() or a whitelist-based serialization approach. Monitor access logs for suspicious patterns indicative of object injection attempts, such as unusual serialized PHP objects in request parameters. For additional details on the vulnerability and patch status, refer to https://patchstack.com/database/Wordpress/Plugin/jquery-archive-list-widget/vulnerability/wordpress-js-archive-list-plugin-6-1-7-php-object-injection-vulnerability?_s_id=cve.