Super Video Player EUVD-2026-96374

Exploitation requires an authenticated session with high privileges (CVSS PR:H - in a WordPress plugin context this typically means administrator-level access) and the ability to submit untrusted serialized data to the Super Video Player plugin feature that performs PHP deserialization. Practical impact beyond object injection is further limited by the need for a usable POP gadget chain in WordPress core, this plugin, or other installed components. Limiting factors: the high privilege prerequisite excludes anonymous and low-privilege users, no user interaction is needed (UI:N), and only installations running Super Video Player version 1.8.13 or earlier are affected.

The input CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) describes a network-reachable, low-complexity PHP Object Injection with full confidentiality, integrity, and availability impact, but gated behind PR:H - high privileges. In the WordPress plugin context this typically means an administrator (or equivalent high-privilege authenticated user) is required to reach the vulnerable deserialization path, which sharply reduces real-world risk: an attacker already holding admin rights on a WordPress site has substantial control regardless of this flaw. No EPSS score was provided, no POC is indicated, and the CVE is not in CISA KEV, so there is no exploitation signal (no public exploit identified at time of analysis). The dominant risk driver is the CWE-502 deserialization primitive, which, if a usable POP (property-oriented programming) gadget chain exists in WordPress core or co-installed plugins/themes, can escalate to remote code execution - but exploitability of object injection is entirely gadget-dependent and unconfirmed here. Net assessment: a genuine but not urgent issue - meaningful for defense-in-depth and against privilege-abuse/compromised-admin scenarios, not a mass-exploitation priority. Conflict to note: the high PR requirement makes the 'network unauthenticated attacker' framing inapplicable; this is an authenticated, privileged-access flaw despite AV:N.

An authenticated high-privilege user (per CVSS PR:H, typically an administrator) submits crafted serialized input to a plugin feature that deserializes untrusted data, triggering PHP Object Injection. If a suitable gadget chain is present in the WordPress stack, this can be leveraged for arbitrary object instantiation leading to data disclosure, tampering, or potential code execution. No public proof-of-concept is identified at time of analysis.