{"id":"CVE-2026-100512","published":"2026-09-30T18:17:59.300","lastModified":"2026-09-30T19:04:41.917","description":"Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-nested-pages/vulnerability/wordpress-nested-pages-plugin-3-3-2-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This flaw allows for PHP object injection in Contributor PHP Object Injection in Nested Pages versions up to 3.3.2, enabling attackers to execute arbitrary code with the privileges of the web server.","exploitability":"Exploitation is relatively straightforward given the critical nature of the vulnerability, requiring only the ability to manipulate input to the affected feature.","blast_radius":"If exploited, this could lead to complete compromise of the affected system, including data theft, unauthorized code execution, and potential lateral movement within the network.","remediation":"Upgrade to Contributor PHP Object Injection in Nested Pages 3.3.3 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","php","object-injection"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-01T08:43:48.893Z"}}