What is the CVSS score of EUVD-2026-59899?

EUVD-2026-59899 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Turnkey bbPress EUVD-2026-59899

| CVE-2026-10035 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-08-16 Wordfence

GHSA-v2rq-f773-w46v

PHP WordPress Information Disclosure Deserialization Wordpress Plugin Turnkey Bbpress By Weavertheme

6.6

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.6 MEDIUM

Administrator credential requirement drives PR:H; POP chain dependency on co-installed code drives AC:H; full C/I/A impact applies only when chain conditions are met.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 16, 2026 - 06:19 vuln.today

CVE Published

Aug 16, 2026 - 05:27 cve.org

MEDIUM 6.6

DescriptionCVE.org

The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbp_set_to_serialized_values() function (reached through the wvrbbp_save_restore() settings-restore handler). The function reads the raw contents of an administrator-uploaded file and passes them directly to unserialize() without any validation. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin itself; however, if a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

AnalysisAI

PHP Object Injection in the Turnkey bbPress by WeaverTheme WordPress plugin (all versions through 1.7.1) allows authenticated administrators to pass arbitrary PHP objects through the plugin's settings-restore handler, which reads an uploaded file's raw contents and passes them directly to unserialize() without validation. The immediate danger is conditional: no POP chain exists within the plugin itself, but any co-installed plugin or theme supplying a POP chain elevates this to arbitrary file deletion, sensitive data retrieval, or remote code execution. No public exploit has been identified at time of analysis, and no active exploitation is confirmed in CISA KEV.

Technical ContextAI

The flaw resides in wvrbbp_set_to_serialized_values() within wvrbbp-admin-lib.php (visible at plugin trac line 132 and line 112), invoked through the wvrbbp_save_restore() settings-restore action. This handler reads the raw byte content of an administrator-uploaded backup file and passes it verbatim to PHP's native unserialize() without sanitization, type-checking, or allowlisting. CWE-502 (Deserialization of Untrusted Data) is the root cause: unserialize() can instantiate any class accessible in the PHP runtime, triggering magic methods (__wakeup, __destruct, __toString) upon object construction. The affected CPE is cpe:2.3:a:wpweaver:turnkey_bbpress_by_weavertheme:*:*:*:*:*:*:*:*, covering all versions through 1.7.1. The attack surface is the WordPress admin-side settings import/restore functionality, which is a common pattern in WordPress plugins and a well-understood target for this class of vulnerability.

RemediationAI

A changeset has been applied to the weaver-for-bbpress repository in the WordPress plugin SVN (changeset 3633471, referenced at https://plugins.trac.wordpress.org/changeset?reponame=&old=3633471%40weaver-for-bbpress&new=3633471%40weaver-for-bbpress), indicating an upstream fix is available; however, the specific released patched version number has not been independently confirmed from the available input data - verify the current version in the WordPress plugin directory and update to any version beyond 1.7.1 once confirmed. If immediate updating is not possible, the most targeted compensating control is to restrict access to the settings-restore/import functionality: use a WordPress security plugin or server-level rules to block POST requests to admin-ajax.php or wp-admin endpoints that invoke the wvrbbp_save_restore action for all users, noting this disables the settings backup/restore feature entirely. Additionally, auditing co-installed plugins and themes for known POP chains reduces the conditional impact even if the deserialization flaw remains. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/7e7411ab-174e-4bc2-9f96-dbce925a21eb for the latest patch version confirmation.