Relevanssi EUVD-2026-109297

Requires an authenticated attacker with high privileges (CVSS PR:H) - in a WordPress context this is effectively administrator-level access to the site running Relevanssi version 4.28.4 or earlier. The specific feature, endpoint, or parameter that deserializes untrusted data is not described in the available sources, and whether a usable POP gadget chain exists (a prerequisite for turning object injection into meaningful impact) is likewise not stated. Limiting factors: the PR:H requirement eliminates unauthenticated and low-privilege attackers, no user interaction is needed once that access is held (UI:N), and the affected version ceiling is 4.28.4.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High) describes a network-reachable, low-complexity flaw with full confidentiality, integrity and availability impact, but gated behind PR:H - high-privilege authentication. That PR:H is the single most important risk-reducer: an attacker already needs high-level (typically administrator-equivalent) access to the WordPress site, which substantially narrows the realistic threat to insider misuse, compromised admin credentials, or chaining from another privilege-granting bug. No EPSS score was supplied, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no proof-of-concept or exploit reference is present in the input - the only reference is a Patchstack advisory database entry, which is an advisory, not exploit code. The vuln.today decision label is 'this_week' (not act_now/emergency), which is consistent with a serious-but-not-actively-exploited authenticated issue. Net: this is a legitimate High-severity deserialization/object-injection bug worth patching promptly, but the PR:H precondition makes it a managed-priority item rather than an emergency; it is not a mass-exploitation-at-the-perimeter scenario on the available signals.

An attacker who already holds high-privilege (admin-level) access to a WordPress site running Relevanssi 4.28.4 or earlier submits crafted serialized PHP data to a plugin code path that unserializes untrusted input, triggering PHP Object Injection. If a suitable POP gadget chain is available in the plugin, WordPress core, or other installed code, this can escalate to data disclosure, data tampering, or code execution. No public exploit code is identified in the available sources, and the exact triggering parameter or feature is not described.