{"id":"CVE-2026-97257","published":"2026-10-05T20:17:29.447","lastModified":"2026-10-06T15:04:25.990","description":"Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/simple-event-planner/vulnerability/wordpress-simple-event-planner-plugin-1-5-7-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw is a deserialization vulnerability that allows object injection, leading to potential remote code execution. This matters because attackers can exploit it to execute arbitrary code on the server, compromising the system.","exploitability":"Exploitation is relatively straightforward given the high CVSS score, requiring only untrusted data deserialization. The vulnerability affects versions from the start through 1.5.7.","blast_radius":"If exploited, the impact could be severe, potentially leading to full system compromise and data loss.","remediation":"Upgrade to Simple Event Planner 1.5.8 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","deserialization","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-06T08:45:12.332Z"}}