CVE-2026-65575

CriticalCVSS 9.8

Published: 06/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Summary

Unauthenticated PHP Object Injection in Accalia versions up to 1.5.3.

An unauthenticated attacker can inject malicious PHP objects, potentially leading to arbitrary code execution or full site compromise.

Update the Accalia plugin to the latest available version that includes the security fix.

Original NVD description (English source)

Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.