{"id":"CVE-2026-66565","published":"2026-10-10T20:16:45.980","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/fcunited/vulnerability/wordpress-fc-united-theme-1-1-1-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A PHP object injection vulnerability in FC United plugin versions 1.1.1 and earlier allows unauthenticated attackers to inject arbitrary PHP objects, leading to potential remote code execution or data compromise.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and can be triggered via a crafted HTTP request, though the specific impact depends on the application's configuration and available classes for deserialization.","blast_radius":"The vulnerability could affect any WordPress site running the FC United plugin version 1.1.1 or earlier, potentially allowing attackers to execute arbitrary code, steal sensitive data, or take full control of affected sites.","remediation":"Upgrade to FC United plugin version 1.1.2 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","php","wordpress","deserialization"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:49:23.370Z"}}