What is the CVSS score of EUVD-2026-57932?

EUVD-2026-57932 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of PHP are affected by EUVD-2026-57932?

The Car Rental Manager WordPress plugin (MagePeople Team, versions ≤1.3.9) contains a PHP Object Injection vulnerability allowing authenticated editor-level users to execute arbitrary code and…

How to fix or mitigate EUVD-2026-57932?

Within 24 hours: audit all WordPress users with editor and higher permissions; identify active plugin usage and create an inventory of affected installations. Within 7 days: restrict editor-level access to trusted administrators only; deploy a WAF rule blocking serialized PHP payloads in POST requests; disable the plugin if unused. Within 30 days: monitor vendor advisories for a patched version; establish an upgrade process and schedule deployment immediately once a patch is released; if no patch materializes within 30 days, evaluate alternative plugins or plan controlled plugin removal.

PHP EUVD-2026-57932

| CVE-2026-27380 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-13 Patchstack

GHSA-qq6j-f2j5-5pfh

PHP WordPress Deserialization Wordpress Plugin Car Rental Manager Magepeopleteam

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:05 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.2

DescriptionCVE.org

Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.

AnalysisAI

PHP Object Injection in the Car Rental Manager WordPress plugin (versions ≤ 1.3.9, by MagePeople Team) enables authenticated editor-level users to supply malicious serialized PHP payloads that are deserialized without validation, potentially triggering arbitrary code execution on the host server. The CVSS 7.2 score reflects the high-privilege prerequisite (PR:H), yet all three impact dimensions — confidentiality, integrity, and availability — score High, meaning successful exploitation can yield full environment compromise. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.