Description
Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2.
Published: 2026-09-10
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is described as a Deserialization of Untrusted Data flaw in the Marcin Wise Chat plugin, allowing PHP object injection. This flaw can allow arbitrary PHP code execution with the permissions of the WordPress process, potentially leading to full site compromise. The weakness is classified as CWE-502.

Affected Systems

The affected product is the WordPress plugin Wise Chat from Marcin. Versions 3.4.2 and earlier are vulnerable. Site administrators running these versions of the plugin should immediately review their installation and plan remediation.

Risk and Exploitability

The CVSS score of 8.1 indicates high severity. The EPSS score of <1% suggests a low likelihood of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is a web‑based request to the plugin’s endpoints that accept serialized data, potentially unauthenticated. Successful exploitation would permit an attacker to execute arbitrary PHP code, compromising confidentiality, integrity, and availability of the WordPress site.

Generated by OpenCVE AI on October 7, 2026 at 08:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Wise Chat to the latest version that eliminates the PHP unserialization flaw (≥ 3.5).
  • If an upgrade is not immediately possible, disable the plugin until a patch is applied.
  • Configure WordPress and the PHP environment to disallow unserialization from untrusted input, such as by setting `unserialize_callback_func` to a safe stub or using PHP's `object` filtering features.

Generated by OpenCVE AI on October 7, 2026 at 08:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 09:45:00 +0000

Type Values Removed Values Added
Description Unauthenticated PHP Object Injection in Wise Chat <= 3.4 versions. Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2.
Title WordPress Wise Chat plugin <= 3.4 - PHP Object Injection vulnerability WordPress Wise Chat plugin <= 3.4.2 - PHP Object Injection vulnerability

Fri, 11 Sep 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Marcin
Marcin wise Chat
Wordpress
Wordpress wordpress
Vendors & Products Marcin
Marcin wise Chat
Wordpress
Wordpress wordpress

Thu, 10 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description Unauthenticated PHP Object Injection in Wise Chat <= 3.4 versions.
Title WordPress Wise Chat plugin <= 3.4 - PHP Object Injection vulnerability
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Marcin Wise Chat
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-06T09:27:41.502Z

Reserved: 2026-08-27T12:24:25.082Z

Link: CVE-2026-81784

cve-icon Vulnrichment

Updated: 2026-09-10T20:55:30.481Z

cve-icon NVD

Status : Deferred

Published: 2026-09-10T15:17:43.817

Modified: 2026-10-06T10:16:52.377

Link: CVE-2026-81784

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T08:15:14Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data