---
id: "CVE-2026-116389"
kind: "vulnerability"
aliases: ["CVE-2026-116389"]
title: "Phoenix Media Rename: untrusted data deserialization lets attackers inject objects"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "phoenix-media-rename", "php", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-28T14:16:58+00:00"
first_seen_at: "2026-10-28T14:33:23+00:00"
updated_at: "2026-10-28T14:34:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116389", "first_seen_at": "2026-10-28T14:33:23+00:00"}]
---

# Phoenix Media Rename: untrusted data deserialization lets attackers inject objects

Phoenix Media Rename, a WordPress plugin by crossi72, deserializes untrusted data without checks, which allows PHP object injection. The sources do not say what an attacker can do with an injected object in this plugin.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `phoenix-media-rename` plugin is installed and its version (the affected range is up to and including `3.13.5`)
- unknown

## Fix

- Update `phoenix-media-rename` to a version later than `3.13.5`, if a fixed release exists
- unknown

## Timeline

- 2026-10-28T14:33:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116389

## From the sources

Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object Injection.This issue affects Phoenix Media Rename: from n/a through 3.13.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_