{"id":"CVE-2026-66482","published":"2026-10-10T20:16:45.493","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/drone-media/vulnerability/wordpress-drone-media-theme-2-2-0-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical PHP object injection vulnerability exists in Drone Media plugin versions up to 2.2.0, allowing unauthenticated attackers to inject arbitrary PHP objects and potentially execute remote code or manipulate application data.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and can be triggered via a crafted HTTP request to the vulnerable endpoint, though successful exploitation may depend on specific server configurations and available deserialization targets.","blast_radius":"The vulnerability could impact any WordPress site running an affected version of Drone Media plugin, potentially leading to full system compromise through remote code execution or unauthorized data manipulation.","remediation":"Upgrade to Drone Media plugin version 2.2.1 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","php-injection","wordpress","web"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:48:00.999Z"}}