CVE-2026-65577

The Advice plugin versions up to 1.18.0 contain an Unauthenticated PHP Object Injection vulnerability. A remote unauthenticated attacker can inject malicious PHP objects, potentially leading to code execution.

The vulnerability allows an unauthenticated attacker to execute malicious code on the server, potentially leading to application compromise.

It is recommended to update the Advice plugin to a version newer than 1.18.0 to mitigate the vulnerability.