Duplicator has unauthenticated PHP object injection (CVE-2026-82814)
Builds through 1.5.17 and Pro 4.6.10 are fixed in 5.0.0; old packages keep the installer that created them.
1
Stories per day · 30 days
9 stories, newest first · one card per story
Stories tagged #php-object-injection
Tutor LMS Flaw Exposes 100,000+ WordPress Sites to Remote Code Execution
A CVSS 8.8 PHP object injection flaw (CVE-2026-78175) in Tutor LMS exposes 100,000+ WordPress sites to subscriber-level remote code execution; patched in 4.0.8.
1
Over 100,000 WordPress Sites Exposed to RCE Through Tutor LMS Vulnerability
Wordfence disclosed CVE-2026-78175, an authenticated PHP object injection chain enabling RCE in Tutor LMS affecting 100,000+ WordPress sites; fixed in 4.0.8.
5
100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS
Wordfence found a PHP object injection flaw in Tutor LMS letting subscriber-level attackers achieve remote code execution on 100,000+ WordPress sites.
Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
Two unauthenticated CVSS 9.8 code-injection and PHP object injection flaws in The Events Calendar plugin expose 200,000+ WordPress sites to RCE and takeover.
3
WordPress Events Calendar Vulnerabilities Let Hackers Take Over 600,000 Websites
Two unauthenticated RCE flaws (CVSS 9.8) in The Events Calendar WordPress plugin threaten 600,000 sites; patched in 6.17.4.1.
1
Critical WordPress Plugin Flaws Put Over 600,000 Websites at Risk of Takeover
Two CVSS 9.8 flaws in The Events Calendar WordPress plugin expose 600,000+ sites to unauthenticated RCE and admin takeover.
1
Critical GiveWP Flaw Lets Attackers Run Commands on WordPress Servers
Critical unauthenticated PHP object injection (CVE-2026-82222) in the GiveWP WordPress donation plugin chains to remote code execution; version 4.16.7.2 fixes it.
2
Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP
Patchstack details an unauthenticated PHP object injection chain enabling remote code execution in the GiveWP WordPress donation plugin.