{"id":"CVE-2026-110369","kind":"vulnerability","aliases":["CVE-2026-110369"],"related":[],"title":"WordPress Team Members plugin: object injection lets attackers run code","description":"Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members allows Object Injection.This issue affects WordPress Team Members – GS Plugins: from n/a through 2.8.2.","summary":"The GS Team Members WordPress plugin unsafely deserializes untrusted data, which is a PHP object injection flaw. Per the sources, an attacker can use it to run code or take over the site, though the exact trigger is not described.","severity":"high","cvss":8.8,"epss":0.00404,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gs-team-members","package","php","wordpress"],"not_affected_if":["plugin-not-installed","version-above-2.8.2"],"how_to_check":"Check the installed plugin version in the WordPress admin under Plugins, or run wp plugin get gs-team-members --field=version. Versions up to and including 2.8.2 are affected.","fix":"Update the GS Team Members plugin to a version later than 2.8.2. If no fixed version is listed, remove the plugin until one is available.","status":"open","published_at":"2026-10-21T10:16:55+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-23T22:33:20+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:33:20Z","model":"claude-haiku-5-5","output":{"fix":"Update the GS Team Members plugin to a version later than 2.8.2. If no fixed version is listed, remove the plugin until one is available.","reach":"internet","title":"WordPress Team Members plugin: object injection lets attackers run code","impact":"high","summary":"The GS Team Members WordPress plugin unsafely deserializes untrusted data, which is a PHP object injection flaw. Per the sources, an attacker can use it to run code or take over the site, though the exact trigger is not described.","category":"package","who_cares":["wordpress","php","gs-team-members"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the web server via crafted serialized input","analyst_note":"Check the NVD entry and the plugin's changelog or the WordPress plugin page for the fixed version and whether unauthenticated input reaches the unserialize call.","how_to_check":"Check the installed plugin version in the WordPress admin under Plugins, or run wp plugin get gs-team-members --field=version. Versions up to and including 2.8.2 are affected.","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-2.8.2"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000516,"input_tokens":2914,"output_tokens":449,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110369':13A,16A '-2026':12A,15A '2.8.2':94C 'affect':85C 'allow':81C 'attack':8A,45B 'code':10A,51B 'cve':11A,14A 'data':33B,67C 'describ':63B 'deseri':31B,64C 'exact':59B 'flaw':40B 'gs':18B,25B,70C,75C,78C,89C 'gs-team-memb':17B,77C 'inject':6A,39B 'injection.this':83C 'issu':84C 'let':7A 'member':3A,20B,27B,74C,80C,88C 'n/a':92C 'object':5A,38B,82C 'packag':21B 'per':41B 'php':22B,37B 'plugin':4A,29B,71C,76C,90C 'run':9A,50B 'site':56B 'sourc':43B 'take':53B 'team':2A,19B,26B,73C,79C,87C 'though':57B 'trigger':60B 'unsaf':30B 'untrust':32B,66C 'use':47B 'vulner':68C 'wordpress':1A,23B,28B,72C,86C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T10:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110369","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110369","severity":null,"published_at":"2026-10-21T10:16:55+00:00","modified_at":"2026-10-21T14:26:26+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-110369","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110369","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}