CVE-2026-66672

CriticalCVSS 9.8

Published: 20/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Summary

Unauthenticated PHP Object Injection vulnerability in Flatastic versions up to 2.0. An attacker can send crafted data to execute arbitrary code.

Risk of taking over the WordPress site and executing malicious code without authentication.

Update the Flatastic plugin to the latest available version that includes the security fix.

Original NVD description (English source)

Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.