{"id":"CVE-2026-97188","published":"2026-10-07T07:17:02.663","lastModified":"2026-10-07T14:52:43.420","description":"The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present via another installed String locator WordPress plugin before 2.6.8 or , this can lead to arbitrary file deletion, sensitive data disclosure or remote code execution.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/cfb495ac-32fc-43e2-81b4-74faa8c164a4/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This flaw allows unauthenticated attackers to store a serialized PHP object, leading to potential arbitrary file deletion, sensitive data disclosure, or remote code execution if a suitable PHP Object Persistence (POP) chain is present.","exploitability":"Exploitation requires unauthenticated access and a suitable PHP Object Persistence (POP) chain, making it moderately difficult.","blast_radius":"If exploited, the impact could be severe, affecting the integrity and confidentiality of the system, potentially leading to remote code execution.","remediation":"Upgrade to String locator WordPress plugin 2.6.8 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","php-object-persistence"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-09T08:43:40.479Z"}}