EUVD-2026-112118
GHSA-9r7q-mmwg-3fhm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged WordPress user
-
DeliverySubmit crafted serialized payload to plugin
-
ExploitTrigger unsafe deserialization (PHP Object Injection)
-
ExecutionReachable gadget chain executes
-
ImpactRemote code execution or data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account with at least low-level privileges (PR:L) on a site running Phoenix Media Rename version n/a through 3.13.5; it is not exploitable by fully unauthenticated visitors. The flaw is Deserialization of Untrusted Data leading to PHP Object Injection, but the exact plugin feature, parameter, or request that reaches the unserialize sink is not described in the available sources. Reliable escalation to code execution depends on a usable PHP gadget chain being present in the plugin or other loaded code, which limits guaranteed impact. The provided data lists no fixed version, so updating guidance cannot be stated from this input. |
| Impact | This is a genuinely high-priority issue, consistent with its 8.8 CVSS and the vuln.today 'this_week' decision label. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity flaw requiring only low-level authentication and no user interaction, with high impact to confidentiality, integrity and availability (C:H/I:H/A:H) - a classic PHP Object Injection / CWE-502 profile that can escalate to remote code execution given a usable gadget chain. The authentication qualifier is supported: PR:L in the vector means an authenticated (low-privileged) attacker, which in WordPress terms is typically a subscriber/contributor-level account. No EPSS score and no CISA KEV entry are present in the input, and no verified working exploit is supplied, so there is no evidence of active exploitation - the elevated priority rests on severity plus Patchstack sourcing rather than confirmed in-the-wild use. Signals are therefore broadly consistent (high severity, low attack complexity) but the real-world exploitation probability is unquantified because EPSS is missing; this is a credible 'patch this week' item rather than a confirmed emergency. |
| Exploit ScenarioDerived | An attacker who holds any low-privileged authenticated account on a WordPress site running Phoenix Media Rename (≤ 3.13.5) submits a crafted serialized payload to a plugin entry point that deserializes untrusted input. If a suitable PHP gadget chain is reachable, the injected object triggers unintended code paths, potentially leading to remote code execution or full compromise of the site's data. No verified public exploit is provided in the available data, though the flaw is low-complexity and needs no user interaction (AC:L/UI:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
PHP object injection in Phoenix Media Rename through 3.13.5 allows an authenticated WordPress user with low-level privileges to trigger unsafe deserialization, which can lead to arbitrary object instantiation and high confidentiality, integrity, and availability impact. The plugin is affected from n/a through 3.13.5, and the supplied CVSS vector confirms network access with low privileges and no user interaction; the exact vulnerable feature or parameter is not described in the available sources. No public exploit identified at time of analysis, and the input does not list a fixed version.
RemediationAI
No vendor-released patch identified at time of analysis, and the supplied data does not give an exact fixed version, so an upgrade target cannot be cited from this input; check the Patchstack advisory URL for updated remediation guidance. If Phoenix Media Rename is not required, disable and remove the plugin, which eliminates exposure but removes its media renaming functionality. Where the plugin must remain, limit low-privilege accounts on affected WordPress sites and restrict access to trusted users as a compensating control, recognizing that this reduces but does not remove risk from any account that can reach the vulnerable deserialization path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-116389 is a CWE-502 deserialization-of-untrusted-data issue in the WordPress plugin Phoenix Media Rename. PHP object injection occurs when attacker-controlled serialized data reaches an unserialize() sink; the immediate effect is instantiation of arbitrary PHP objects, and further impact depends on whether usable gadget chains exist in the plugin or other loaded WordPress code. The CPE cpe:2.3:a:crossi72:phoenix_media_rename:*:*:*:*:*:*:*:* identifies the plugin as the affected component, and the supplied CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable flaw requiring a low-privileged authenticated account with no user interaction. The specific plugin feature, request parameter, or code path that reaches the deserialization sink is not described in the available sources.
Know when Phoenix Media Rename gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable PHP object injection needing only a low-privileged authenticated account and no user interaction, with object injection capable of high C/I/A impact via a gadget chain.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object Injection.This issue affects Phoenix Media Rename: from n/a through 3.13.5.
Executive ViewAI
Phoenix Media Rename plugin (up to 3.13.5) contains a high-severity PHP object injection vulnerability that could allow low-privileged authenticated users to compromise the entire WordPress site. This puts sensitive data, site integrity, and availability at risk, impacting the organization's reputation and operations.
Disable or remove the plugin if not essential; enforce strict least-privilege access controls, limiting low-privileged user accounts, and deploy a WAF with rules to detect and block PHP object injection attempts.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB