What is the CVSS score of CVE-2026-65556?

CVE-2026-65556 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of WPBruiser are affected by CVE-2026-65556?

WPBruiser, a commonly-used WordPress anti-spam plugin, contains a critical vulnerability in versions 3.1.43 and earlier that allows unauthenticated attackers to execute code or access sensitive data…

How to fix or mitigate CVE-2026-65556?

Within 24 hours, audit all WordPress installations to identify which are running WPBruiser version 3.1.43 or earlier and assess their criticality and internet exposure. Within 7 days, either deactivate and remove the plugin entirely from all affected sites or migrate to a supported alternative anti-spam solution such as Akismet or native Jetpack security features. Within 30 days, monitor for vendor patches through Patchstack advisory EUVD-2026-53983 and evaluate deployment if one becomes available; if no patch materializes, confirm all WordPress installations use actively-maintained anti-spam alternatives.

WPBruiser CVE-2026-65556

EUVD-2026-53983 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-06 Patchstack

GHSA-f7mx-xq66-8fmx

PHP WordPress Deserialization Wordpress Plugin Wpbruiser No Captcha Anti Spam

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable deserialization (AV:N/PR:N/UI:N/AC:L); worst-case POP chain yields full C/I/A compromise, matching the reported vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:52 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.

Articles & Coverage 1

News Critical PHP Object Injection in WPBruiser WordPress Plugin - CVE-2026-65556 Aug 07, 2026

AnalysisAI

PHP Object Injection in the WPBruiser {no- Captcha anti-Spam} WordPress plugin (versions ≤ 3.1.43) allows remote unauthenticated attackers to inject crafted serialized objects that are deserialized by the plugin, enabling arbitrary object instantiation and, when combined with a suitable POP gadget chain, code execution or data compromise. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is reported by Patchstack (EUVD-2026-53983). No public exploit code was identified at time of analysis and it is not listed in CISA KEV, so there is no confirmed active exploitation.

Technical ContextAI

WPBruiser is an anti-spam plugin for WordPress (vendor identifier 'mihche', formerly branded goodbye-captcha) that intercepts form submissions to block bots without CAPTCHAs. The vulnerability is a CWE-502 Deserialization of Untrusted Data issue: attacker-controlled input reaches a PHP unserialize() call (or equivalent), allowing instantiation of arbitrary PHP objects. In WordPress, PHP Object Injection is dangerous because the plugin executes within a large ecosystem of loaded classes (WordPress core, other plugins, libraries) that can supply 'POP gadget' chains whose magic methods (__wakeup, __destruct, __toString) trigger file writes, SQL queries, or code execution when the object is destroyed or used. The CPE cpe:2.3:a:mihche:wpbruiser_{no-_captcha_anti-spam} identifies the exact affected package.

RemediationAI

Upgrade to a fixed release above 3.1.43 as soon as the vendor publishes one; the input data does not include a confirmed fixed version, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/goodbye-captcha/vulnerability/wordpress-wpbruiser-no-captcha-anti-spam-plugin-3-1-43-php-object-injection-vulnerability) for the patched version before deploying. Until a patched version is confirmed and installed, the safest compensating control is to deactivate and remove the WPBruiser plugin (trade-off: you lose its anti-spam protection and should substitute an alternative such as a WAF-based or CAPTCHA solution). If removal is not acceptable, place the site behind a WAF with virtual-patching/PHP-object-injection rules (e.g. Patchstack or comparable) to filter serialized payloads reaching the plugin's endpoints, and restrict or monitor the form/AJAX endpoints the plugin handles - noting a WAF is a mitigation, not a guaranteed block against obfuscated serialized input.