CVE-2026-0726 describes a PHP Object Injection vulnerability in the Nexter Extension – Site Enhancements Toolkit plugin for WordPress, affecting all versions up to 4.4.6. This flaw allows unauthenticated attackers to inject PHP Objects through deserialization of untrusted input in the 'nxt_unserialize_replace' function. The vulnerability has a CVSS score of 8.1 (HIGH) due to its network attack vector and high impact on confidentiality, integrity, and availability, though its exploit complexity is high as it requires a separate POP chain from another plugin or theme to be present for any impact. Currently, there is no evidence of active exploitation, and no public exploit code is available on Metasploit or ExploitDB, despite significant community discussion and mentions on GitHub.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Posimyththemes | Nexter Extension – Security, Performance, Code Snippets & Site Toolkit | >= 0, <= 4.4.6CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.