{"id":"CVE-2026-78529","published":"2026-10-10T20:16:46.590","lastModified":"2026-10-13T13:29:12.567","description":"Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/alliance/vulnerability/wordpress-alliance-theme-3-11-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical PHP object injection vulnerability allows unauthenticated attackers to inject arbitrary PHP objects into the application, potentially leading to remote code execution. This flaw affects Alliance versions up to 3.11 and can be exploited without any authentication.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and can be triggered through vulnerable input parameters, making it highly attractive to attackers seeking to compromise affected systems.","blast_radius":"The impact could be severe across all installations running Alliance 3.11 or earlier, potentially allowing attackers to execute arbitrary code on the server with full system privileges.","remediation":"Upgrade to Alliance 3.12 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","php","injection","web"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:49:44.517Z"}}