GS Team Members EUVD-2026-107158

Exploitation requires an authenticated WordPress account with at least low privileges (PR:L) on a site running GS Plugins 'WordPress Team Members' (gs-team-members) plugin version 2.8.2 or earlier; no user interaction is needed. The attacker must reach a plugin feature that deserializes attacker-controlled input via PHP unserialize(). Practical impact is further gated by the availability of a usable POP gadget chain within the plugin, WordPress core, or other installed plugins/themes - without such a chain, the object injection may not yield code execution. Limiting factors: the authentication requirement (sites that disallow untrusted user registration are substantially less exposed) and dependence on gadget availability for full compromise.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) and base score of 8.8 indicate a network-reachable, low-complexity flaw requiring only low-level authentication (PR:L) and no user interaction, with high impact to confidentiality, integrity, and availability - consistent with PHP Object Injection via CWE-502 insecure deserialization. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis'; this tempers the otherwise high score. A key caveat for object-injection flaws: real-world impact (and effective complexity) hinges on the presence of a usable POP gadget chain in the plugin or in other installed plugins/themes, which the available data does not confirm - so the 'C:H/I:H/A:H' rating represents worst-case potential rather than a demonstrated RCE. The PR:L requirement meaningfully limits risk, as the attacker must first hold at least a low-privilege authenticated account on the target WordPress site. Overall this is a credible medium-to-high priority for sites running the affected plugin, but not a mass-exploitation emergency absent KEV/EPSS/POC signals; prioritize patching where untrusted users can register.

A low-privileged authenticated user (e.g., a subscriber or contributor) submits crafted input to a vulnerable endpoint of the GS Team Members plugin that is passed to PHP's unserialize(), injecting a malicious serialized object. If a suitable POP gadget chain exists in the WordPress installation, this is leveraged to achieve file operations, SQL injection, or remote code execution. No public exploit code is identified in the provided data, and exploitation requires authentication (PR:L) but no user interaction.