Description
Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.
Published: 2026-10-18
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Deserialization of untrusted data in the WordPress Strong Testimonials plugin allows attackers to inject PHP objects, which can lead to arbitrary code execution. The flaw is a classic deserialization weakness (CWE-502) and may compromise confidentiality, integrity, and availability if successfully exploited.

Affected Systems

The vulnerability affects the WP Chill Strong Testimonials plugin for WordPress versions up to and including 3.3.12. Any site running the plugin in a version at or below 3.3.12 is impacted.

Risk and Exploitability

The CVSS score of 8.8 classifies this flaw as high‑severity. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog. The most likely attack vector is through user‑controlled data that the plugin unserializes, such as form submissions or URL parameters. Conditional for exploitation is that the WordPress instance accepts serialized data from untrusted sources and that the plugin processes it without prior validation.

Generated by OpenCVE AI on October 18, 2026 at 12:27 UTC.

Remediation

Vendor Solution

Update the WordPress Strong Testimonials plugin to the latest available version (at least 3.3.13).

OpenCVE Recommended Actions

  • Update the WordPress Strong Testimonials plugin to version 3.3.13 or later.
  • If an immediate upgrade is not possible, permanently disable or remove the plugin from the site until the patch is applied.
  • Audit any custom input that may contain serialized data and enforce strict validation or use a secure deserialization library instead of PHP’s native unserialize function.

Generated by OpenCVE AI on October 18, 2026 at 12:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 11:15:00 +0000

Type Values Removed Values Added
Description Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.
Title WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-18T11:00:30.528Z

Reserved: 2026-10-08T00:19:19.567Z

Link: CVE-2026-107436

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T11:16:34.720

Modified: 2026-10-18T11:16:34.720

Link: CVE-2026-107436

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T12:30:14Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data