{"id":"CVE-2026-114704","kind":"vulnerability","aliases":["CVE-2026-114704"],"related":[],"title":"Relevanssi WordPress plugin: untrusted data object injection through version 4.28.4","description":"Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi  relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.","summary":"Relevanssi, a WordPress search plugin, deserializes untrusted data, which is an object injection flaw. An attacker who can reach the vulnerable path may be able to run code or manipulate data on the site.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","relevanssi","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Relevanssi version in the WordPress admin plugin list or with `wp plugin get relevanssi --field=version`\n- Treat any installed version up to and including `4.28.4` as affected","fix":"- Update Relevanssi to a version later than `4.28.4` once the vendor release is confirmed in the plugin repository\n- unknown for the exact fixed version, as the sources do not name it","status":"open","published_at":"2026-10-24T14:16:39+00:00","first_seen_at":"2026-10-24T14:48:21+00:00","triaged_at":"2026-10-25T03:27:37+00:00","updated_at":"2026-10-25T03:27:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:27:37Z","model":"claude-haiku-5-5","output":{"fix":"- Update Relevanssi to a version later than `4.28.4` once the vendor release is confirmed in the plugin repository\n- unknown for the exact fixed version, as the sources do not name it","reach":"internet","title":"Relevanssi WordPress plugin: untrusted data object injection through version 4.28.4","impact":"high","summary":"Relevanssi, a WordPress search plugin, deserializes untrusted data, which is an object injection flaw. An attacker who can reach the vulnerable path may be able to run code or manipulate data on the site.","category":"package","nicknames":[],"who_cares":["wordpress","relevanssi","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker may trigger object injection leading to code execution","analyst_note":"Confirm the fixed version and the exact vulnerable code path, and whether authentication is required, from the NVD entry and the plugin changelog.","how_to_check":"- Check the installed Relevanssi version in the WordPress admin plugin list or with `wp plugin get relevanssi --field=version`\n- Treat any installed version up to and including `4.28.4` as affected","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Relevanssi WordPress plugin at version 4.28.4 or earlier are affected. Sites that do not have the plugin installed can skip it. The sources do not say which settings or roles make the flaw reachable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000605,"input_tokens":3297,"output_tokens":551,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114704':13A,16A '-2026':12A,15A '4.28.4':10A,76C 'abl':47B 'affect':71C 'allow':67C 'attack':38B 'christoph':63C 'code':50B 'cve':11A,14A 'data':5A,30B,53B,60C 'deseri':28B,57C 'flaw':36B 'host':21B 'inject':7A,35B 'injection.this':69C 'issu':70C 'manipul':52B 'may':45B 'n/a':74C 'object':6A,34B,68C 'packag':17B 'path':44B 'plugin':3A,27B 'reach':41B 'relevanssi':1A,18B,23B,65C,66C,72C 'run':49B 'search':26B 'self':20B 'self-host':19B 'site':56B 'untrust':4A,29B,59C 'version':9A 'vielgrad':64C 'vulner':43B,61C 'wordpress':2A,22B,25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Relevanssi WordPress plugin at version 4.28.4 or earlier are affected. Sites that do not have the plugin installed can skip it. The sources do not say which settings or roles make the flaw reachable.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T14:16:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114704","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114704","severity":null,"published_at":"2026-10-24T14:16:39+00:00","modified_at":"2026-10-24T14:16:39+00:00","first_seen_at":"2026-10-24T14:48:21+00:00","fetched_at":"2026-10-24T14:48:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}