CVE-2026-97188

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present via another installed String locator WordPress plugin before 2.6.8 or , this can lead to arbitrary file deletion, sensitive data disclosure or remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Oct 7, 2026
Last modified
Oct 7, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-97194.3The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all CVE-2026-971969.1Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication Bypass. This issue CVE-2026-971977.5Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.CVE-2026-97204.3The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includingCVE-2026-972043.1Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequencCVE-2026-972058.1NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in cerCVE-2026-972067.5NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client CVE-2026-972084.9The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enablCVE-2026-97214.3The Book a Room Event Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9. TCVE-2026-972127.3The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the saCVE-2026-972194.3The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated uCVE-2026-97224.3The Laiser Tag plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to