{"id":"CVE-2026-66564","published":"2026-10-10T20:16:45.857","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/shift-cv/vulnerability/wordpress-shiftcv-theme-3-0-14-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical PHP object injection vulnerability exists in ShiftCV versions 3.0.14 and earlier, allowing unauthenticated attackers to inject arbitrary PHP objects that can lead to remote code execution, data compromise, and full system takeover.","exploitability":"Exploitation is relatively straightforward as the vulnerability is unauthenticated and affects a web application endpoint, requiring no prior access or credentials to trigger the object injection.","blast_radius":"The impact could be severe across all installations running ShiftCV 3.0.14 or earlier, potentially affecting multiple users and systems that rely on this content management platform.","remediation":"Upgrade to ShiftCV version 3.0.15 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","php","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:48:15.738Z"}}