Complianz EUVD-2026-48108

Exploitation requires an authenticated WordPress Administrator account (CVSS PR:H), because the vulnerable deserialization path is reachable only through admin-privileged functionality of the Complianz plugin. The attacker must supply a crafted serialized PHP object to the admin input that Complianz passes to unserialize(), and a usable POP gadget chain must exist among the classes loaded by WordPress core, Complianz, or other active plugins. Limiting factors: the mandatory Administrator privilege level sharply narrows the attacker population to existing high-trust users (or those who have already compromised such an account); no unauthenticated or low-privilege path is indicated, and no user interaction is required (UI:N).

The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High) shows a network-reachable, low-complexity attack with full confidentiality, integrity, and availability impact, but critically requires PR:H - Administrator-level privileges. This precondition substantially lowers real-world risk: an attacker who already holds a WordPress admin account has significant capability regardless, so the practical uplift is primarily converting admin access into PHP-level code execution and potentially deeper server compromise. No EPSS score, SSVC decision data, or KEV listing was supplied, and no POC is referenced, so exploitation appears theoretical rather than active. Overall this is a defense-in-depth / privilege-boundary hardening issue rather than an urgent internet-facing emergency, though it is meaningful in multi-admin or delegated-admin environments where not every administrator is fully trusted.

An attacker who has obtained or been granted a WordPress Administrator account on a site running Complianz <= 7.5.0 submits a crafted serialized PHP object through an admin-accessible plugin input. When Complianz deserializes the value, a POP gadget chain in the loaded PHP class set is triggered, letting the attacker escalate from admin-level web access to arbitrary PHP execution or file/database tampering on the server. No public POC was referenced, so an attacker would need to develop the gadget chain themselves.