#Object Injection
All CosmicBytez Labs articles tagged #Object Injection, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-107249: Drupal Block AJAX Object Injection (CVSS 9.8)
Improperly controlled modification of object attributes in the Drupal Block AJAX module allows object injection. Versions up to 3.0.2 are affected.
- Security
CVE-2026-104398: Critical Object Injection in WooCommerce AFFI Affiliate Marketing Plugin
A deserialization flaw in VillaTheme's AFFI WooCommerce plugin allows unauthenticated PHP object injection, risking full site takeover.
- Security
CVE-2026-0551: PHP Object Injection in PPWP – Password Protect Pages WordPress Plugin
PPWP WordPress plugin up to 1.9.18 allows contributor-level PHP object injection via deserialization, enabling RCE on affected sites.
- Security
WordPress ARForms Plugin Critical PHP Object Injection — CVE-2024-13784
A critical unauthenticated PHP object injection flaw in the ARForms WordPress plugin (CVSS 9.8) allows arbitrary code execution via deserialization.
- Security
CVE-2026-45247 — Mirasvit Magento 2 Cache Warmer PHP Object Injection RCE
CVSS 9.8 PHP object injection in Mirasvit Full Page Cache Warmer for Magento 2 lets unauthenticated attackers achieve RCE — patch to 1.11.12 now.
- Security
CVE-2026-25449: Critical Object Injection in Shinetheme
A CVSS 9.8 deserialization vulnerability in the Shinetheme Traveler WordPress plugin allows unauthenticated remote attackers to inject arbitrary PHP...