{"id":"CVE-2026-110370","kind":"vulnerability","aliases":["CVE-2026-110370"],"related":[],"title":"WordPress GS Pins for Pinterest: untrusted data object injection flaw","description":"Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins for Pinterest gs-pinterest-portfolio allows Object Injection.This issue affects GS Pins for Pinterest: from n/a through 1.9.2.","summary":"The GS Pins for Pinterest WordPress plugin deserializes untrusted data, which allows PHP object injection. Depending on available gadget chains on the site, an attacker may be able to run code or alter data on the server.","severity":"high","cvss":8.8,"epss":0.00404,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gs-pins-for-pinterest","gs-pinterest-portfolio","package","wordpress"],"not_affected_if":["plugin-not-installed","version-above-1.9.2"],"how_to_check":"Check the installed plugin version in the WordPress admin Plugins page or the plugin's readme; versions through 1.9.2 are affected.","fix":"Update GS Pins for Pinterest to a version later than 1.9.2 or remove the plugin; no fixed version is named in the sources.","status":"open","published_at":"2026-10-21T10:16:55+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-23T22:33:19+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:33:19Z","model":"claude-haiku-5-5","output":{"fix":"Update GS Pins for Pinterest to a version later than 1.9.2 or remove the plugin; no fixed version is named in the sources.","reach":"internet","title":"WordPress GS Pins for Pinterest: untrusted data object injection flaw","impact":"high","summary":"The GS Pins for Pinterest WordPress plugin deserializes untrusted data, which allows PHP object injection. Depending on available gadget chains on the site, an attacker may be able to run code or alter data on the server.","category":"package","who_cares":["wordpress","gs-pins-for-pinterest","gs-pinterest-portfolio"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker injects PHP objects that may lead to code execution on the server","analyst_note":"Confirm the fixed version and whether unauthenticated access is needed; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-110370 and the WordPress plugin changelog.","how_to_check":"Check the installed plugin version in the WordPress admin Plugins page or the plugin's readme; versions through 1.9.2 are affected.","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-1.9.2"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000532,"input_tokens":2940,"output_tokens":476,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110370':13A,16A '-2026':12A,15A '1.9.2':93C 'abl':55B 'affect':85C 'allow':39B,81C 'alter':60B 'attack':52B 'avail':45B 'chain':47B 'code':58B 'cve':11A,14A 'data':7A,37B,61B,68C 'depend':43B 'deseri':35B,65C 'flaw':10A 'gadget':46B 'gs':2A,18B,23B,29B,71C,73C,78C,86C 'gs-pins-for-pinterest':17B 'gs-pinterest-portfolio':22B,77C 'inject':9A,42B 'injection.this':83C 'issu':84C 'may':53B 'n/a':91C 'object':8A,41B,82C 'packag':26B 'php':40B 'pin':3A,19B,30B,74C,87C 'pinterest':5A,21B,24B,32B,76C,79C,89C 'plugin':34B,72C 'portfolio':25B,80C 'run':57B 'server':64B 'site':50B 'untrust':6A,36B,67C 'vulner':69C 'wordpress':1A,27B,33B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T10:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110370","severity":null,"published_at":"2026-10-21T10:16:55+00:00","modified_at":"2026-10-21T14:26:26+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-110370","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110370","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}