What is the CVSS score of EUVD-2026-60913?

EUVD-2026-60913 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of OptionTree Plugin are affected by EUVD-2026-60913?

The OptionTree WordPress plugin version 2.7.3 and earlier contains a PHP object injection vulnerability enabling arbitrary code execution on affected servers through authenticated administrator…

How to fix or mitigate EUVD-2026-60913?

Within 24 hours, audit all WordPress installations to identify OptionTree plugin deployments (version 2.7.3 and earlier) and restrict editor access to only essential administrator accounts; document all active administrators with plugin Editor interface permissions. Within 7 days, implement Web Application Firewall rules to monitor the plugin's editor endpoints for suspicious serialization patterns and enable comprehensive logging of all administrator actions within WordPress. Within 30 days, monitor the plugin vendor's security advisories for patch availability; if no patch is released, evaluate alternative WordPress plugins with equivalent functionality or begin migration planning to reduce the attack surface.

OptionTree Plugin EUVD-2026-60913

| CVE-2026-66620 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-18 Patchstack

GHSA-rcj8-2wj2-6g63

PHP WordPress Deserialization Wordpress Plugin Optiontree

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-accessible WordPress admin panel (AV:N, AC:L) but administrator credentials required (PR:H); full code execution yields C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 15:18 vuln.today

CVE Published

Aug 18, 2026 - 13:59 cve.org

HIGH 7.2

DescriptionCVE.org

Editor PHP Object Injection in OptionTree <= 2.7.3 versions.

AnalysisAI

PHP Object Injection in the OptionTree WordPress plugin (versions <= 2.7.3) enables authenticated administrators to submit crafted serialized PHP data through the plugin's Editor interface, triggering dangerous deserialization that can culminate in arbitrary code execution on the host server. The CVSS vector (PR:H) confirms that exploitation is gated behind WordPress administrator credentials, constraining the immediate threat surface. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

OptionTree (CPE: cpe:2.3:a:derek_herman:optiontree) is a WordPress plugin by Derek Herman that provides a theme options framework with an in-browser Editor for managing option sets. The vulnerability maps to CWE-502 (Deserialization of Untrusted Data): the plugin passes attacker-controlled input into PHP's native unserialize() function without sanitization. When a serialized PHP object graph is deserialized, PHP automatically invokes 'magic methods' such as __destruct, __wakeup, and __toString on the instantiated objects. An attacker can craft a Property-Oriented Programming (POP) chain using classes already loaded in the WordPress/PHP runtime, chaining these magic method calls to achieve arbitrary file writes, code execution, or other high-impact operations entirely within the PHP process.

RemediationAI

No vendor-released patched version has been independently confirmed from the available intelligence data - the affected range is listed only as <= 2.7.3 with no stated fixed release. Site operators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/option-tree/vulnerability/wordpress-optiontree-plugin-2-7-3-php-object-injection-vulnerability for the latest patch status. As immediate compensating controls: deactivate or uninstall the OptionTree plugin if not actively required for site operation (no side effects for non-dependent themes; dependent themes may lose options UI). If the plugin must remain active, restrict WordPress administrator access to only fully trusted, individually accountable accounts and enforce multi-factor authentication on all admin accounts to reduce credential-theft risk. Deploy a WAF rule blocking serialized PHP object patterns (e.g., 'O:[0-9]+:') in HTTP POST bodies to the WordPress admin endpoint - trade-off is potential false positives if other plugins legitimately serialize data. Monitor web server logs and the filesystem for unexpected PHP file creation under wp-content.