CVE-2026-66620

HighCVSS 7.2

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

30th percentile - higher than 30% of all known CVEs

Summary

PHP Object Injection vulnerability in OptionTree versions up to 2.7.3, requiring editor privileges. An attacker can inject serialized PHP objects, potentially leading to arbitrary code execution.

Risk Assessment

Risk of remote code execution, server compromise, or data theft if exploited by a user with editor privileges.

Recommendation

Update OptionTree to the latest patched version.

Original NVD description (English source)

Editor PHP Object Injection in OptionTree <= 2.7.3 versions.