{"id":"CVE-2026-116389","kind":"vulnerability","aliases":["CVE-2026-116389"],"related":[],"title":"Phoenix Media Rename: untrusted data deserialization lets attackers inject objects","description":"Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object Injection.This issue affects Phoenix Media Rename: from n/a through 3.13.5.","summary":"Phoenix Media Rename, a WordPress plugin by crossi72, deserializes untrusted data without checks, which allows PHP object injection. The sources do not say what an attacker can do with an injected object in this plugin.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","phoenix-media-rename","php","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `phoenix-media-rename` plugin is installed and its version (the affected range is up to and including `3.13.5`)\n- unknown","fix":"- Update `phoenix-media-rename` to a version later than `3.13.5`, if a fixed release exists\n- unknown","status":"open","published_at":"2026-10-28T14:16:58+00:00","first_seen_at":"2026-10-28T14:33:23+00:00","triaged_at":"2026-10-28T14:34:15+00:00","updated_at":"2026-10-28T14:34:15+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-28T14:34:15Z","model":"claude-haiku-5-5","output":{"fix":"- Update `phoenix-media-rename` to a version later than `3.13.5`, if a fixed release exists\n- unknown","reach":"unknown","title":"Phoenix Media Rename: untrusted data deserialization lets attackers inject objects","impact":"high","summary":"Phoenix Media Rename, a WordPress plugin by crossi72, deserializes untrusted data without checks, which allows PHP object injection. The sources do not say what an attacker can do with an injected object in this plugin.","category":"package","nicknames":[],"who_cares":["wordpress","php","phoenix-media-rename"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; object injection may allow code execution, depending on available gadgets","analyst_note":"Confirm the fixed version, the attack path and the auth requirement from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-116389) or the plugin's advisory.","how_to_check":"- Check whether the `phoenix-media-rename` plugin is installed and its version (the affected range is up to and including `3.13.5`)\n- unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Phoenix Media Rename plugin at version 3.13.5 or earlier. The sources do not say which configuration or role is needed to reach the vulnerable code path.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000595,"input_tokens":3306,"output_tokens":528,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116389':13A,16A '-2026':12A,15A '3.13.5':84C 'affect':77C 'allow':38B,73C 'attack':8A,49B 'check':36B 'crossi72':31B,65C 'cve':11A,14A 'data':5A,34B,62C 'deseri':6A,32B,59C 'inject':9A,41B,54B 'injection.this':75C 'issu':76C 'let':7A 'media':2A,20B,25B,67C,71C,79C 'n/a':82C 'object':10A,40B,55B,74C 'packag':17B 'phoenix':1A,19B,24B,66C,70C,78C 'phoenix-media-renam':18B,69C 'php':22B,39B 'plugin':29B,58B 'renam':3A,21B,26B,68C,72C,80C 'say':46B 'sourc':43B 'untrust':4A,33B,61C 'vulner':63C 'without':35B 'wordpress':23B,28B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Phoenix Media Rename plugin at version 3.13.5 or earlier. The sources do not say which configuration or role is needed to reach the vulnerable code path.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T14:16:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116389","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116389","severity":null,"published_at":"2026-10-28T14:16:58+00:00","modified_at":"2026-10-28T14:16:58+00:00","first_seen_at":"2026-10-28T14:33:23+00:00","fetched_at":"2026-10-28T14:33:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}