What is the CVSS score of CVE-2026-59521?

CVE-2026-59521 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Wordpress Plugin are affected by CVE-2026-59521?

The Real Testimonials WordPress plugin (versions ≤3.1.15) contains a PHP object injection vulnerability allowing high-privileged administrators to trigger arbitrary code execution.

How to fix or mitigate CVE-2026-59521?

Within 24 hours: Audit all WordPress administrator account activity and credential access logs; identify and document all WordPress installations running Real Testimonials plugin versions 3.1.15 and earlier. Within 7 days: Disable or remove the Real Testimonials plugin from all affected WordPress instances; implement strict administrator access controls, IP whitelisting for admin interfaces, and multi-factor authentication for privileged accounts; deploy Web Application Firewall (WAF) rules to detect serialized object injection patterns. Within 30 days: Identify and evaluate alternative testimonial solutions or update to a patched version if released; implement application-level monitoring for suspicious deserialization activity; conduct security assessment of compromised instances and review audit logs for evidence of exploitation.

Wordpress Plugin CVE-2026-59521

EUVD-2026-43432 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-13 Patchstack

WordPress Deserialization Wordpress Plugin Real Testimonials

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:21 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.2

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimonials: from n/a through <= 3.1.15.

AnalysisAI

PHP Object Injection in the ShapedPlugin Real Testimonials (testimonial-free) WordPress plugin affects all versions up to and including 3.1.15, allowing a high-privileged authenticated user to inject serialized PHP objects that the plugin unsafely deserializes. Depending on gadget chains present in WordPress core, other active plugins, or themes, this can escalate to arbitrary code execution, data disclosure, or site compromise. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.