https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T15:32:38.779389+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-97188 CVE-2026-97188 — String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor 2026-10-07T15:32:38.780430+00:00

Affected: Unknown String locator

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present via another installed String locator WordPress plugin before 2.6.8 or , this can lead to arbitrary file deletion, sensitive data disclosure or remote code execution.