How do I check whether I am affected by CVE-2026-114196?

- Check the installed Paytium version in the WordPress admin plugin list or with `wp plugin get paytium --field=version` - unknown if other checks are needed

What is the fix for CVE-2026-114196?

- Update Paytium to a version later than `5.0.5` - unknown whether a patched version number is published in the sources

Who is not affected by CVE-2026-114196?

Not affected if: plugin-not-installed.

Live › vulnerability › CVE-2026-114196

Go to dashboard

critical9.8Package

Paytium WordPress plugin: untrusted data deserialization lets attackers inject objects

Paytium, a WordPress payment plugin, deserializes untrusted data without checks, allowing PHP object injection. The sources do not say what an attacker can do with an injected object, but object injection on a site often leads to code execution.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 24, 2026 UTC
Last modified: Oct 24, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-24 08:47 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker injects PHP objects, possibly running code on the server.
CVSS said: 9.8. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

Sites running the Paytium WordPress plugin version or earlier. The sources do not describe the exact code path or required role, so treat any site with the plugin installed as in scope. Sites without Paytium can skip it.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-114196

Go to dashboard

critical9.8Package

Paytium WordPress plugin: untrusted data deserialization lets attackers inject objects

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 24, 2026 UTC
Last modified: Oct 24, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-24 08:47 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker injects PHP objects, possibly running code on the server.
CVSS said: 9.8. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

Paytium WordPress plugin: untrusted data deserialization lets attackers inject objects

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

Paytium WordPress plugin: untrusted data deserialization lets attackers inject objects

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources