Live › vulnerability › CVE-2026-116865
Zippy, a WordPress editor plugin, deserializes untrusted PHP object data in versions up to 1.7.0. An attacker who can supply that data can cause unintended PHP object behavior on the server, which can lead to code execution depending on the available gadget chains.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
WordPress sites with the Zippy plugin (archive/export-import of posts) at 1.7.0 or earlier, which is every current release. The CVSS vector needs high privileges (PR:H), so the risk is mainly an admin account being compromised or abused, and code execution depends on a gadget chain in other installed plugins or themes. Sites without Zippy can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| zippy | wordpress-plugin | <= 1.7.0 | – |
1.7.0 is the latest release on wordpress.org and is affectedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Editor PHP Object Injection in Zippy <= 1.7.0 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116865")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.