CVE-2026-65578

The Agora plugin versions up to 1.9 contain an Unauthenticated PHP Object Injection vulnerability. A remote unauthenticated attacker can inject malicious PHP objects, potentially leading to code execution.

The vulnerability allows an unauthenticated attacker to execute malicious code on the server, potentially leading to application compromise.

It is recommended to update the Agora plugin to a version newer than 1.9 to mitigate the vulnerability.