CVE-2026-73993

CriticalCVSS 9.8

Published: 20/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Summary

Unauthenticated PHP Object Injection vulnerability in the FundEngine plugin. Affects versions up to 1.7.9.

An unauthenticated attacker can inject malicious PHP objects, potentially leading to remote code execution or data manipulation.

Update the FundEngine plugin to a version that fixes this vulnerability and validate input data.

Original NVD description (English source)

Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.