CVE-2026-114704

WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability

Published Oct 24, 2026 CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Description

Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.

Analysis

Technical impact

Deserialization of untrusted data in the WordPress Relevanssi plugin allows PHP object injection. An attacker who can influence the data that the plugin deserializes could instantiate malicious objects, potentially leading to arbitrary code execution on the host where the WordPress site runs.

Affected Systems

All installations of the Relevanssi plugin with a version less than or equal to 4.28.4 are affected. This includes any WordPress website using the plugin before the 4.28.5 release.

Risk and Exploitability

The CVSS score of 7.2 indicates a high severity. While no EPSS score is available, the risk remains significant because the vulnerability exploits a common injection weakness (CWE-502). It is not currently listed in CISA’s KEV catalog. The likely attack vector is remote, achievable by supplying crafted serialized payloads through normal plugin operations, and could allow an unauthenticated attacker to execute code on the server.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Christoph Vielgrader

Relevanssi

unaffected

Version	Status	Constraints
`0`	affected	≤ 4.28.4

No data.

No data available yet.

Remediation

Vendor Solution

Update the WordPress Relevanssi plugin to the latest available version (at least 4.28.5).

OpenCVE Recommended Actions

Update the Relevanssi plugin to version 4.28.5 or later.
Audit custom code that feeds user-supplied data into Relevanssi deserialization routines and enforce strict validation or sanitization.
If the plugin is not essential to site functionality, disable or uninstall it to eliminate the vulnerability.

Generated by OpenCVE AI on October 24, 2026 at 15:21 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.413% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://patchstack.com/database/wordpress/plugin/relevanssi/vulnerability/wordpress-relevanssi-plugin-4-28-4-php-object-injection-vulnerability?_s_id=cve

History

Oct 24, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 24, 2026 2:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.
Title		WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability
Weaknesses		CWE-502
References		https://patchstack.com/database/wordpress/plugin/relevanssi/vulnerability/wordpress-relevanssi-plugin-4-28-4-php-object-injection-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}`