What is the CVSS score of CVE-2026-59521?

CVE-2026-59521 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Real Testimonials are affected by CVE-2026-59521?

The Real Testimonials WordPress plugin (versions ≤3.1.15) contains a PHP object injection vulnerability allowing high-privileged administrators to trigger arbitrary code execution.

How to fix or mitigate CVE-2026-59521?

Within 24 hours: Audit all WordPress administrator account activity and credential access logs; identify and document all WordPress installations running Real Testimonials plugin versions 3.1.15 and earlier. Within 7 days: Disable or remove the Real Testimonials plugin from all affected WordPress instances; implement strict administrator access controls, IP whitelisting for admin interfaces, and multi-factor authentication for privileged accounts; deploy Web Application Firewall (WAF) rules to detect serialized object injection patterns. Within 30 days: Identify and evaluate alternative testimonial solutions or update to a patched version if released; implement application-level monitoring for suspicious deserialization activity; conduct security assessment of compromised instances and review audit logs for evidence of exploitation.

Real Testimonials CVE-2026-59521

EUVD-2026-43432 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-13 Patchstack

Deserialization Real Testimonials

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:21 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.2

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimonials: from n/a through <= 3.1.15.

AnalysisAI

PHP Object Injection in the ShapedPlugin Real Testimonials (testimonial-free) WordPress plugin affects all versions up to and including 3.1.15, allowing a high-privileged authenticated user to inject serialized PHP objects that the plugin unsafely deserializes. Depending on gadget chains present in WordPress core, other active plugins, or themes, this can escalate to arbitrary code execution, data disclosure, or site compromise. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Audit all WordPress administrator account activity and credential access logs; identify and document all WordPress installations running Real Testimonials plugin versions 3.1.15 and earlier. …

Threat intelligence, references, and detailed analysis are available after sign-in.