CVE-2026-7635: PHP Object Injection in WordPress Activity Logging
Plattform
wordpress
Komponente
coreactivity
Behoben in
3.1
CVE-2026-7635 describes a PHP Object Injection vulnerability affecting the coreActivity: Activity Logging for WordPress plugin. This flaw allows unauthenticated attackers to inject malicious PHP code, potentially leading to remote code execution and complete compromise of the WordPress site. The vulnerability impacts versions 0.0 through 3.0, and a fix is available in version 3.1.
Erkenne diese CVE in deinem Projekt
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Auswirkungen und Angriffsszenarien
The impact of this vulnerability is significant. Successful exploitation allows an attacker to inject arbitrary PHP code into the WordPress environment. This could lead to a complete takeover of the website, including data theft, modification, and defacement. An attacker could also leverage this access to move laterally within the network if the WordPress instance has access to other systems. The ability to inject code via a simple HTTP header makes exploitation relatively straightforward, increasing the potential for widespread attacks. This vulnerability shares similarities with other PHP object injection flaws where improper handling of unserialized data can lead to code execution.
Ausnutzungskontext
CVE-2026-7635 was published on May 13, 2026. The vulnerability's severity is rated HIGH with a CVSS score of 8.1. Public proof-of-concept (POC) code is likely to emerge given the relatively simple exploitation path. While no active campaigns have been publicly reported as of this writing, the ease of exploitation suggests it could become a target for opportunistic attackers. Monitor security advisories and threat intelligence feeds for updates.
Bedrohungsanalyse
Exploit-Status
CISA SSVC
CVSS-Vektor
Was bedeuten diese Metriken?
- Attack Vector
- Netzwerk — aus der Ferne über das Internet ausnutzbar. Kein physischer oder lokaler Zugriff erforderlich.
- Attack Complexity
- Hoch — erfordert eine Race-Condition, Nicht-Standard-Konfiguration oder spezifische Umstände.
- Privileges Required
- Keine — ohne Authentifizierung ausnutzbar. Keine Zugangsdaten erforderlich.
- User Interaction
- Keine — automatischer und lautloser Angriff. Das Opfer tut nichts.
- Scope
- Unverändert — Auswirkung auf das anfällige Komponente beschränkt.
- Confidentiality
- Hoch — vollständiger Vertraulichkeitsverlust. Angreifer kann alle Daten lesen.
- Integrity
- Hoch — Angreifer kann beliebige Daten schreiben, ändern oder löschen.
- Availability
- Hoch — vollständiger Absturz oder Ressourcenerschöpfung. Totaler Denial of Service.
Betroffene Software
Schwachstellen-Klassifikation (CWE)
Zeitleiste
- Reserved
- Veröffentlicht
Mitigation und Workarounds
The primary mitigation is to immediately upgrade the coreActivity: Activity Logging for WordPress plugin to version 3.1 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a temporary workaround by filtering or stripping potentially malicious characters from the User-Agent header before it is stored in the database. Web Application Firewalls (WAFs) can be configured to detect and block requests containing suspicious serialized PHP objects in the User-Agent header. Specifically, look for patterns associated with PHP serialization syntax. After upgrading, verify the fix by sending a request with a crafted User-Agent header containing a benign serialized object and confirming that it is not stored or executed.
So beheben
Aktualisieren Sie auf Version 3.1 oder eine neuere gepatchte Version
Häufig gestellte Fragen
What is CVE-2026-7635 — PHP Object Injection in WordPress Activity Logging?
CVE-2026-7635 is a HIGH severity vulnerability in the coreActivity: Activity Logging for WordPress plugin. It allows attackers to inject malicious PHP code via the User-Agent HTTP header, potentially leading to remote code execution.
Am I affected by CVE-2026-7635 in WordPress Activity Logging?
If you are using the coreActivity: Activity Logging for WordPress plugin in versions 0.0 through 3.0, you are affected by this vulnerability. Upgrade to version 3.1 or later to mitigate the risk.
How do I fix CVE-2026-7635 in WordPress Activity Logging?
The recommended fix is to upgrade the coreActivity: Activity Logging for WordPress plugin to version 3.1 or later. As a temporary workaround, filter or strip potentially malicious characters from the User-Agent header.
Is CVE-2026-7635 being actively exploited?
While no active campaigns have been publicly reported, the ease of exploitation suggests it could become a target for opportunistic attackers. Continuous monitoring is recommended.
Where can I find the official WordPress advisory for CVE-2026-7635?
Refer to the coreActivity: Activity Logging for WordPress plugin's official website or the WordPress plugin repository for the latest advisory and update information.
Ist dein Projekt betroffen?
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Erkenne diese CVE in deinem Projekt
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Scannen Sie jetzt Ihr WordPress-Projekt – kein Konto
Laden Sie ein Manifest hoch (composer.lock, package-lock.json, WordPress Plugin-Liste…) oder fügen Sie Ihre Komponentenliste ein. Sie erhalten sofort einen Schwachstellenbericht. Das Hochladen einer Datei ist nur der Anfang: Mit einem Konto erhalten Sie kontinuierliche Überwachung, Slack/email-Benachrichtigungen, Multi-Projekt- und White-Label-Berichte.
Abhängigkeitsdatei hier ablegen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...