What is the CVSS score of CVE-2026-65497?

CVE-2026-65497 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Complianz are affected by CVE-2026-65497?

Complianz WordPress plugin (all versions through 7.5.0) contains a code execution vulnerability that allows administrators to execute arbitrary commands and manipulate site data.

How to fix or mitigate CVE-2026-65497?

Within 24 hours, conduct a complete inventory of WordPress installations using Complianz plugin through version 7.5.0 via plugin management tools or vulnerability scanners. Within 7 days, audit all administrator accounts on affected sites, review recent access logs for suspicious activity, and enforce strong password policies or credential rotation for admin users; identify and remove unnecessary administrative accounts. Within 30 days, establish monitoring for Complianz security advisories and prepare an upgrade strategy; upon availability of a patched version from the Complianz plugin vendor, schedule testing in a staging environment and deploy to production according to your change management policy.

Complianz CVE-2026-65497

EUVD-2026-48108 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-23 Patchstack

GHSA-8f2q-4292-vgvq

PHP WordPress Deserialization Complianz Wordpress Plugin

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable admin endpoint (AV:N/AC:L/UI:N) but requires an Administrator account, so PR:H; successful object injection yields full code-execution-level impact, hence C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:30 vuln.today

CVE Published

Jul 23, 2026 - 11:19 cve.org

HIGH 7.2

DescriptionCVE.org

Administrator PHP Object Injection in Complianz <= 7.5.0 versions.

Articles & Coverage 1

News 10 New PHP Vulnerabilities - 2 Critical, 8 High, 3 With POC Jul 24, 2026

AnalysisAI

PHP Object Injection in the Complianz WordPress plugin (all versions up to and including 7.5.0) allows an authenticated user with Administrator privileges to inject serialized PHP objects that the plugin later deserializes, enabling arbitrary object instantiation and potential remote code execution or data manipulation. The flaw stems from unsafe deserialization (CWE-502) and carries a CVSS 7.2 (High). No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was privately disclosed by Patchstack.

Technical ContextAI

Complianz (also known as Complianz GDPR/Cookie Consent) is a widely used WordPress consent-management and privacy plugin. The vulnerability is a CWE-502 Deserialization of Untrusted Data (PHP Object Injection): attacker-controlled input reaches a PHP unserialize() call (or equivalent) without validation, allowing crafted serialized objects to be instantiated. When such objects are instantiated, their PHP magic methods (__wakeup, __destruct, etc.) can be abused as a 'POP gadget chain' - leveraging classes loaded by WordPress core, other plugins, or PHP itself - to reach dangerous sinks such as file writes, SQL operations, or code execution. The single CPE cpe:2.3:a:complianz:complianz:*:*:*:*:*:*:*:* confirms the affected component is the Complianz plugin application across unpatched versions.

RemediationAI

Upgrade the Complianz plugin to the first release above 7.5.0 that addresses this issue as published on the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/complianz-gdpr/vulnerability/wordpress-complianz-plugin-7-5-0-php-object-injection-vulnerability); an exact fixed version number was not provided in the source data, so verify the patched release on the vendor's changelog before deploying. Because exploitation requires Administrator privileges, the strongest compensating controls are tightening who holds admin rights: enforce least-privilege by removing unnecessary Administrator accounts, require MFA on all admin logins, and audit delegated/multi-site super-admin assignments (trade-off: operational friction for legitimate admins). Additionally, deploy a WordPress WAF/virtual-patch (Patchstack or equivalent) to block serialized-object payloads to plugin endpoints, and restrict wp-admin access by IP allowlisting where feasible (trade-off: breaks remote administration from dynamic IPs).