{"id":"CVE-2026-94683","published":"2026-09-30T13:17:27.940","lastModified":"2026-09-30T14:18:01.733","description":"Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/designsetgo/vulnerability/wordpress-designsetgo-plugin-2-8-0-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This flaw allows remote attackers to inject PHP objects, leading to potential code execution or data corruption. It matters because it can be exploited to gain unauthorized access or disrupt the system.","exploitability":"Exploitation requires the ability to control input to the DesignSetGo application, making it moderately hard to exploit. Precondition is that the application is running an affected version.","blast_radius":"If exploited, the impact could be severe, potentially allowing full control over the affected system or data loss.","remediation":"Upgrade to DesignSetGo 2.8.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","php","web","code-execution"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-03T08:49:45.901Z"}}