{"id":"CVE-2026-116390","kind":"vulnerability","aliases":["CVE-2026-116390"],"related":[],"title":"WordPress Filter Everything plugin: object injection flaw through version 1.9.7","description":"Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything — WordPress & WooCommerce Filters: from n/a through 1.9.7.","summary":"The Filter Everything plugin for WordPress and WooCommerce unsafely deserializes untrusted data, which is a PHP object injection flaw. Depending on the available gadget chains on the site, an attacker may be able to run code or change application data.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/filter-everything/` header of the main plugin file.\n- Confirm whether the installed version is `1.9.7` or earlier, which the sources list as affected.","fix":"- Update the Filter Everything plugin to a version later than `1.9.7`; the sources do not name the exact fixed release, so check the plugin's changelog.\n- If no patched release is available, deactivate the plugin until it is updated.","status":"open","published_at":"2026-10-28T14:16:58+00:00","first_seen_at":"2026-10-28T14:33:23+00:00","triaged_at":"2026-10-28T14:34:26+00:00","updated_at":"2026-10-28T14:34:26+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T14:34:26Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Filter Everything plugin to a version later than `1.9.7`; the sources do not name the exact fixed release, so check the plugin's changelog.\n- If no patched release is available, deactivate the plugin until it is updated.","reach":"internet","title":"WordPress Filter Everything plugin: object injection flaw through version 1.9.7","impact":"high","summary":"The Filter Everything plugin for WordPress and WooCommerce unsafely deserializes untrusted data, which is a PHP object injection flaw. Depending on the available gadget chains on the site, an attacker may be able to run code or change application data.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","php"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker may run code or alter data through injected PHP objects","analyst_note":"Confirm the fixed version and the triggering request path from the NVD entry and the plugin changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/filter-everything/` header of the main plugin file.\n- Confirm whether the installed version is `1.9.7` or earlier, which the sources list as affected.","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Filter Everything plugin version 1.9.7 or earlier, with WordPress or WooCommerce product filtering enabled. The sources do not say which request paths or settings trigger the deserialization, so treat any site with the plugin installed as in scope. Sites that do not have the plugin installed are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000638,"input_tokens":3348,"output_tokens":607,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116390':13A,16A '-2026':12A,15A '1.9.7':10A,89C 'abl':53B 'affect':80C 'allow':76C 'applic':59B 'attack':50B 'avail':43B 'chain':45B 'chang':58B 'code':56B 'cve':11A,14A 'data':32B,60B,64C 'depend':40B 'deseri':30B,61C 'everyth':3A,23B,69C,75C,82C 'filter':2A,22B,68C,72C,74C,81C,85C 'filter-everyth':73C 'flaw':7A,39B 'gadget':44B 'inject':6A,38B 'injection.this':78C 'issu':79C 'may':51B 'n/a':87C 'object':5A,37B,77C 'packag':17B 'php':18B,36B 'plugin':4A,24B 'run':55B 'site':48B 'stepasyuk':67C 'unsaf':29B 'untrust':31B,63C 'version':9A 'vulner':65C 'woocommerc':19B,28B,71C,84C 'wordpress':1A,20B,26B,70C,83C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Filter Everything plugin version 1.9.7 or earlier, with WordPress or WooCommerce product filtering enabled. The sources do not say which request paths or settings trigger the deserialization, so treat any site with the plugin installed as in scope. Sites that do not have the plugin installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T14:16:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116390","severity":null,"published_at":"2026-10-28T14:16:58+00:00","modified_at":"2026-10-28T14:16:58+00:00","first_seen_at":"2026-10-28T14:33:23+00:00","fetched_at":"2026-10-28T14:33:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}