{"id":"CVE-2026-114196","published":"2026-10-24T08:16:51.963","lastModified":"2026-10-26T13:41:11.497","description":"Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/paytium/vulnerability/wordpress-paytium-plugin-5-0-5-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Paytium plugin for WordPress before 5.0.6 contains a deserialization vulnerability (CWE-502) that allows unauthenticated remote attackers to inject arbitrary PHP objects, potentially leading to remote code execution or data manipulation.","exploitability":"Exploitation is straightforward for remote attackers with network access, as it requires only sending a specially crafted serialized payload to a vulnerable endpoint without authentication.","blast_radius":"Successful exploitation could lead to full system compromise including unauthorized data access, modification of website content, or execution of arbitrary server-side code.","remediation":"Upgrade Paytium to version 5.0.6 or later, which contains the vendor's official fix for this deserialization vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["deserialization","object-injection","web","wordpress"],"model":"garnet-coder","analyzedAt":"2026-10-24T09:03:13.829Z"}}