EUVD-2026-89831
GHSA-qw4j-3mfx-55x8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable endpoint with low complexity, Contributor auth gives PR:L, no interaction; deserialization can yield full C/I/A impact assuming a reachable gadget chain, matching the vendor rating.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.
AnalysisAI
PHP object injection in the WordPress plugin SEO Plugin by Squirrly SEO (through version 14.2.5) allows an authenticated attacker with only Contributor-level access to feed crafted serialized data into PHP's unserialize(), which can escalate to remote code execution, arbitrary file operations, or SQL injection if a usable POP gadget chain is reachable in the plugin, WordPress core, or another installed plugin. The flaw scores CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is a genuine high-priority issue, but the practical blast radius depends on two prerequisites: the site must permit untrusted or self-registered Contributor accounts, and a viable gadget chain must exist. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress account with at least Contributor role (PR:L) on a site running SEO Plugin by Squirrly SEO version 14.2.5 or earlier; no user interaction is needed (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue but with an important caveat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Primary remediation is to update the SEO Plugin by Squirrly SEO to a release newer than 14.2.5 as soon as the vendor publishes it; the available advisory data does not identify a specific patched version, so confirm the fixed release on the plugin's WordPress.org page or the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/squirrly-seo/vulnerability/wordpress-seo-plugin-by-squirrly-seo-plugin-14-2-5-php-object-injection-vulnerability?_s_id=cve) before assuming a given version is safe, and treat patch status as unconfirmed in the meantime. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress sites running Squirrly SEO plugin version 14.2.5 or earlier, immediately restrict or disable self-registration of Contributor-level accounts, audit existing Contributor accounts for legitimacy, and deploy WAF virtual patching rules to block serialized data in requests if feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today