---
id: "CVE-2026-114704"
kind: "vulnerability"
aliases: ["CVE-2026-114704"]
title: "Relevanssi WordPress plugin: untrusted data object injection through version 4.28.4"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "relevanssi", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-24T14:16:39+00:00"
first_seen_at: "2026-10-24T14:48:21+00:00"
updated_at: "2026-10-25T03:27:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114704", "first_seen_at": "2026-10-24T14:48:21+00:00"}]
---

# Relevanssi WordPress plugin: untrusted data object injection through version 4.28.4

Relevanssi, a WordPress search plugin, deserializes untrusted data, which is an object injection flaw. An attacker who can reach the vulnerable path may be able to run code or manipulate data on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Relevanssi version in the WordPress admin plugin list or with `wp plugin get relevanssi --field=version`
- Treat any installed version up to and including `4.28.4` as affected

## Fix

- Update Relevanssi to a version later than `4.28.4` once the vendor release is confirmed in the plugin repository
- unknown for the exact fixed version, as the sources do not name it

## Timeline

- 2026-10-24T14:48:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114704

## From the sources

Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi  relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_