{"id":"CVE-2026-66568","published":"2026-10-10T20:16:46.347","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/original/vulnerability/wordpress-original-theme-1-9-0-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical PHP object injection vulnerability allows unauthenticated attackers to inject malicious PHP objects into the application, potentially leading to remote code execution and full system compromise. This affects Original versions up to 1.9.0.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and can be triggered via a crafted HTTP request, though it may require knowledge of the specific object structure to achieve full RCE.","blast_radius":"If exploited, this vulnerability could lead to complete system compromise with potential for data exfiltration, persistence mechanisms, and lateral movement across the network.","remediation":"Upgrade to Original version 1.9.1 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","php","injection","web"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:49:33.868Z"}}