Cotonti Comments Plugin CVE-2026-91939

Exploitation requires that the target Cotonti 1.0.0 installation has the Comments plugin enabled and rendering the Comments widget, which reads the ci GET parameter and passes it through base64_decode() into unserialize() without an allowed_classes restriction. No authentication, privileges, or user interaction are needed (PR:N/UI:N) against a default deployment that includes the Comments plugin. The practical limiting factor is the availability of a usable PHP POP gadget chain in Cotonti's codebase or bundled libraries to convert object instantiation into concrete code execution or database manipulation; the deserialization sink itself is unconditionally reachable, but full RCE depends on such a chain existing.

The CVSS 4.0 base score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) reflects a genuinely severe pre-authentication vulnerability: PHP object injection (CWE-502) reachable over the network with no privileges or user interaction, driven by the Comments plugin passing the base64-decoded ci GET parameter straight into unserialize() with no allowed_classes restriction. The vendor-confirmed fix in PR #1889 (adding ['allowed_classes' => false] plus strict structural validation) directly corroborates the described root cause, so the technical claim is well-supported by primary source code evidence. However, the practical impact hinges on the availability of a usable POP gadget chain within Cotonti or its bundled libraries - the raw unserialize() sink is confirmed, but 'database manipulation or code execution' is the described potential, not an independently verified end-to-end exploit. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; treat 'in the wild' claims as unsupported. Net: a real, high-severity, easily-reachable bug in a low-prevalence CMS - prioritize patching for any Cotonti operator, but the aggregate internet-wide risk is tempered by the product's small deployment footprint and the absence of a published weaponized chain.

An unauthenticated attacker crafts a malicious serialized PHP object, base64-encodes it, and supplies it as the ci GET parameter to a page rendering the Comments widget. Cotonti unserializes it without class restrictions, instantiating an attacker-controlled object whose magic methods (e.g. __destruct/__wakeup) trigger a gadget chain leading to database manipulation or code execution. No public exploit is identified at time of analysis, though the sink and fix are confirmed in the vendor PR.