Live › vulnerability › CVE-2026-116389
Go to dashboardPhoenix Media Rename, a WordPress plugin by crossi72, deserializes untrusted data without checks, which allows PHP object injection. The sources do not say what an attacker can do with an injected object in this plugin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 14:33 UTC. All times on this page are UTC.
Sites running the Phoenix Media Rename plugin at version 3.13.5 or earlier. The sources do not say which configuration or role is needed to reach the vulnerable code path.
No product ranges from the sources yet.
phoenix-media-rename plugin is installed and its version (the affected range is up to and including 3.13.5)phoenix-media-rename to a version later than 3.13.5, if a fixed release existsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object Injection.This issue affects Phoenix Media Rename: from n/a through 3.13.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-116389")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.