CVE-2026-42723

The CleanSkin plugin in versions up to and including 1.5.0 contains a PHP Object Injection vulnerability exploitable by an unauthenticated attacker. The lack of required authorization allows exploitation without an account.

An attacker can inject a malicious PHP object, potentially leading to code execution, data disclosure, or website takeover. The threat depends on available gadgets in the application.

Update the CleanSkin plugin to a version newer than 1.5.0 or disable it. Consider auditing the code for unsafe deserialization.