{"id":"CVE-2026-116865","kind":"vulnerability","aliases":["CVE-2026-116865"],"related":[],"title":"Zippy editor: PHP object injection in versions up to 1.7.0","description":"Editor PHP Object Injection in Zippy <= 1.7.0 versions.","summary":"Zippy, a WordPress editor plugin, deserializes untrusted PHP object data in versions up to 1.7.0. An attacker who can supply that data can cause unintended PHP object behavior on the server, which can lead to code execution depending on the available gadget chains.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"zippy","fixed":[],"affected":"<= 1.7.0","ecosystem":"wordpress-plugin"}],"ecosystems":[],"tags":["package","php","wordpress","wordpress-plugin","zippy"],"not_affected_if":["plugin-deactivated","plugin-not-installed"],"how_to_check":"- WordPress admin > Plugins: is Zippy installed and active, and is its version 1.7.0 or lower? Or run: wp plugin get zippy --field=version\n- Any installed version is affected, as 1.7.0 is the latest release.","fix":"No fixed version: 1.7.0 is the latest release on wordpress.org and is affected. Remove or deactivate the plugin until the maintainer ships a patch.","status":"open","published_at":"2026-10-29T16:18:01+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","triaged_at":"2026-10-29T16:29:50+00:00","updated_at":"2026-10-29T16:39:16+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T16:29:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Zippy editor: PHP object injection in versions up to 1.7.0","impact":"high","summary":"Zippy, a WordPress editor plugin, deserializes untrusted PHP object data in versions up to 1.7.0. An attacker who can supply that data can cause unintended PHP object behavior on the server, which can lead to code execution depending on the available gadget chains.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","zippy","php"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Server-side PHP object injection could allow code execution","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and the vulnerable input path (https://nvd.nist.gov/vuln/detail/CVE-2026-116865).","how_to_check":"- Check whether the Zippy plugin is installed and its version (the sources name versions up to `1.7.0`)\n- unknown for other checks; the sources do not say which inputs reach the vulnerable code","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Zippy editor plugin at version 1.7.0 or earlier are in scope according to the NVD entry. The sources do not describe the exact input path, so whether a given site is reachable is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000671,"input_tokens":4042,"output_tokens":533,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and the vulnerable input path (https://nvd.nist.gov/vuln/detail/CVE-2026-116865).","search":"'-116865':13A,16A '-2026':12A,15A '1.7.0':10A,39B,74C 'attack':41B 'avail':65B 'behavior':52B 'caus':48B 'chain':67B 'code':60B 'cve':11A,14A 'data':34B,46B 'depend':62B 'deseri':30B 'editor':2A,28B,68C 'execut':61B 'gadget':66B 'inject':5A,71C 'lead':58B 'object':4A,33B,51B,70C 'packag':18B 'php':3A,19B,32B,50B,69C 'plugin':23B,29B 'server':55B 'suppli':44B 'unintend':49B 'untrust':31B 'version':7A,36B,75C 'wordpress':20B,22B,27B 'wordpress-plugin':21B 'zippi':1A,24B,25B,73C 'zippy':17A","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the Zippy plugin (archive/export-import of posts) at 1.7.0 or earlier, which is every current release. The CVSS vector needs high privileges (PR:H), so the risk is mainly an admin account being compromised or abused, and code execution depends on a gadget chain in other installed plugins or themes. Sites without Zippy can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116865","severity":null,"published_at":"2026-10-29T16:18:01+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","fetched_at":"2026-10-29T16:25:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116865:1081","url":null,"severity":null,"published_at":"2026-10-29T16:39:16+00:00","modified_at":"2026-10-29T16:39:16+00:00","first_seen_at":"2026-10-29T16:39:16+00:00","fetched_at":"2026-10-29T16:39:16+00:00","note":"Patchstack (reported by Patchstack researcher, 17 Sep 2026, published 28 Oct) says <=1.7.0 affected, no official patch; wordpress.org shows 1.7.0 is still latest (changelog has no fix for this). Required privilege not legible on page (NVD vector PR:H, so high-privilege). Not verified: Patchstack is a third-party DB. No PoC/exploitation found."}],"documents":[{"id":17840,"url":"https://patchstack.com/database/wordpress/plugin/zippy/vulnerability/wordpress-zippy-plugin-1-7-0-php-object-injection-vulnerability","title":"Patchstack: Zippy <= 1.7.0 PHP Object Injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":17841,"url":"https://wordpress.org/plugins/zippy/","title":"Zippy plugin page and changelog (wordpress.org), latest 1.7.0","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}