What is the CVSS score of EUVD-2026-13657?

EUVD-2026-13657 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Totalcontest Lite are affected by EUVD-2026-13657?

The TotalContest Lite WordPress plugin contains a critical vulnerability that allows privileged attackers to inject malicious code and compromise website integrity and data.

How to fix or mitigate EUVD-2026-13657?

Within 24 hours: Inventory all WordPress installations running TotalContest Lite plugin version 2.9.1 or earlier and restrict administrative access to trusted personnel only. Within 7 days: Deactivate and remove the vulnerable plugin from all affected systems, or implement WAF rules to block suspicious serialized object requests to the plugin directories. Within 30 days: Evaluate alternative contest/competition plugins from trusted vendors, deploy a web application firewall with PHP object injection detection, and implement code review processes for third-party plugins before deployment.

Totalcontest Lite EUVD-2026-13657

| CVE-2026-0677 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-03-20 Patchstack

Deserialization Totalcontest Lite

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Severity Changed

Jun 10, 2026 - 20:22 NVD

HIGH MEDIUM

CVSS changed

Jun 10, 2026 - 20:22 NVD

7.2 (HIGH) 6.3 (MEDIUM)

EUVD ID Assigned

Mar 20, 2026 - 09:45 euvd

EUVD-2026-13657

Analysis Generated

Mar 20, 2026 - 09:45 vuln.today

CVE Published

Mar 20, 2026 - 09:31 nvd

HIGH 7.2

DescriptionNVD

Deserialization of Untrusted Data vulnerability in TotalSuite TotalContest Lite allows Object Injection.This issue affects TotalContest Lite: from n/a through 2.9.1.

AnalysisAI

This is a deserialization of untrusted data vulnerability (PHP Object Injection) in the TotalContest Lite WordPress plugin that allows authenticated attackers with high-level privileges to inject arbitrary PHP objects. The vulnerability affects all versions through 2.9.1 of the TotalContest Lite plugin from TotalSuite. With a CVSS score of 7.2, successful exploitation can lead to high impact on confidentiality, integrity, and availability of the affected system.

Technical ContextAI

The vulnerability stems from CWE-502 (Deserialization of Untrusted Data), which occurs when an application deserializes untrusted data without proper validation. In PHP applications like WordPress plugins, this manifests as PHP Object Injection, where attackers can manipulate serialized objects to instantiate arbitrary classes and trigger magic methods (__wakeup, __destruct, etc.). The affected product is identified via CPE as cpe:2.3:a:totalsuite:totalcontest_lite, a WordPress plugin by TotalSuite. When vulnerable unserialize() functions process attacker-controlled input, they can trigger object instantiation chains that lead to remote code execution, SQL injection, or other severe impacts depending on available classes in the application scope.

RemediationAI

Upgrade TotalContest Lite to version 2.9.2 or later if available, as version 2.9.1 is confirmed vulnerable. Check the official TotalSuite website or WordPress plugin repository for the latest patched version. Review the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/totalcontest-lite/vulnerability/wordpress-totalcontest-lite-plugin-2-9-1-php-object-injection-vulnerability?_s_id=cve for specific patch information. As an interim mitigation, restrict administrative access to the WordPress installation using strong authentication mechanisms, implement IP allowlisting for administrator logins, and audit all users with high-privilege roles to ensure no compromised accounts exist. Consider temporarily disabling the plugin if contest functionality is not immediately required until a confirmed patch is applied.