First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-49107

CriticalCVSS 9.8/10Last modified Oct 23, 2026

Description

Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Thrive Themes	Thrive Apprentice	< 10.8.10.2

References

https://patchstack.com/database/wordpress/plugin/thrive-apprentice/vulnerability/wordpress-thrive-apprentice-plugin-10-8-10-2-php-object-injection-vulnerability?_s_id=cve

Timeline

Published: Jun 17, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-491089.8Unauthenticated PHP Object Injection in Moderno < 1.43 versions.CVE-2026-491099.8Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 CVE-2026-49115.3The Booking Package plugin for WordPress is vulnerable to Price Manipulation in versions up to, and including, 1.7.06 This is due to the int CVE-2026-491107.5Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce <= 3.1.4 versions.CVE-2026-491118.8Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allows Privilege Escalation. This issue affects Masteriyo - LMS:CVE-2026-491127.5Unauthenticated Path Traversal in Shared Files <= 1.7.64 versions.CVE-2026-491138.5Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions.CVE-2026-491147.1In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field an CVE-2026-491197.5Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated CVE-2026-49124.1The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and includ CVE-2026-491208.5Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authenticated users to per CVE-2026-491219.8AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability in the MessageQueue.recv()

CVE-2026-49107: Critical severity, CVSS 9.8 | Vulnix