---
id: "CVE-2026-107436"
kind: "vulnerability"
aliases: ["CVE-2026-107436"]
title: "WordPress Strong Testimonials plugin: untrusted data object injection flaw"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "strong-testimonials", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-18T11:16:34+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-23T22:33:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107436", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# WordPress Strong Testimonials plugin: untrusted data object injection flaw

The Strong Testimonials WordPress plugin deserializes untrusted data, which is a PHP object injection flaw. Sources say an attacker can inject objects, but do not state the exact outcome beyond that.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether the Strong Testimonials plugin is installed and its version is 3.3.12 or earlier, for example in the WordPress admin Plugins page or with wp plugin list.

## Fix

Update Strong Testimonials to a version newer than 3.3.12. Fixed version is unknown from the sources.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107436

## From the sources

Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_