CVE-2026-10035
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The Turnkey bbPress by WeaverTheme plugin for WordPress up to version 1.7.1 is vulnerable to PHP Object Injection via deserialization of untrusted input in the wvrbbp_set_to_serialized_values() function. The function reads raw file contents and passes them directly to unserialize() without validation, allowing authenticated attackers with administrator-level access and above to inject a PHP Object.
Risk Assessment
If a POP chain exists (e.g., from another plugin), an attacker could delete arbitrary files, retrieve sensitive data, or execute code, potentially leading to full server compromise.
Recommendation
Update the Turnkey bbPress plugin to the latest patched version. Restrict admin access to trusted users and regularly audit installed plugins for POP chains.
Original NVD description (English source)
The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbp_set_to_serialized_values() function (reached through the wvrbbp_save_restore() settings-restore handler). The function reads the raw contents of an administrator-uploaded file and passes them directly to unserialize() without any validation. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin itself; however, if a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.