CVE-2026-107436
8.8HighPublished 18 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-502
Impact
Authenticated attackers with low privileges can trigger arbitrary PHP object injection, potentially leading to remote code execution or complete site compromise. They only need network access and a valid low-privilege WordPress user account.
Root cause
The plugin unsafely deserializes user-controlled input without adequate validation.
Affected systems
Strong Testimonials through 3.3.12
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Strong Testimonials to a version higher than 3.3.12 once available, or deactivate and remove the plugin immediately if patching is not yet an option.
$ wp plugin update strong-testimonialsAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.