CVE-2026-100512

CriticalCVSS 9.8

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Summary

PHP Object Injection vulnerability in Nested Pages plugin up to version 3.3.2. Allows an attacker to inject malicious PHP objects.

Risk Assessment

May lead to remote code execution or unauthorized data access in WordPress application.

Recommendation

Update the Nested Pages plugin to the latest patched version.

Other vulnerabilities in Nested Pages

CVE-2026-15233Medium
The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen. This allows users with the Editor role (or Contributor/Author when enabled) to inject arbitrary JavaScript that executes in the session of any higher-privileged user who views that screen.

Original NVD description (English source)

Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS