CVE-2026-65556

CriticalCVSS 9.8

Published: 06/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Summary

Unauthenticated PHP Object Injection in WPBruiser (no-Captcha anti-Spam) versions up to 3.1.43.

An unauthenticated attacker can exploit this vulnerability to execute malicious code or take control of the WordPress site.

Update the WPBruiser plugin to the latest version that addresses this vulnerability.

Original NVD description (English source)

Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.