CVE-2026-27414
HighCVSS 8.8Summary
The Werkstatt plugin for WordPress versions 4.8.3 and earlier contains a PHP Object Injection vulnerability via the contributor mechanism. This allows an attacker to inject malicious objects, potentially leading to remote code execution.
Risk Assessment
The risk includes potential takeover of the WordPress site, data theft, or server compromise by an attacker with contributor privileges.
Recommendation
Immediately update the Werkstatt plugin to version 4.8.4 or later, which fixes this vulnerability.
Other vulnerabilities in Werkstatt
See all- CVE-2026-57690Medium
The Werkstatt plugin version 4.7.2 and earlier contains an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated administrator.
- CVE-2026-57689Medium
The Werkstatt plugin in versions 4.7.2 and earlier contains a broken access control vulnerability for subscribers. This allows users with the subscriber role to gain unauthorized access to functions or data.
Original NVD description (English source)
Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions.