---
id: "CVE-2026-116865"
kind: "vulnerability"
aliases: ["CVE-2026-116865"]
title: "Zippy editor: PHP object injection in versions up to 1.7.0"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "zippy", "fixed": [], "affected": "<= 1.7.0", "ecosystem": "wordpress-plugin"}]
ecosystems: []
tags: ["package", "php", "wordpress", "wordpress-plugin", "zippy"]
not_affected_if: ["plugin-deactivated", "plugin-not-installed"]
published_at: "2026-10-29T16:18:01+00:00"
first_seen_at: "2026-10-29T16:25:57+00:00"
updated_at: "2026-10-29T16:39:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116865", "first_seen_at": "2026-10-29T16:25:57+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T16:39:16+00:00"}]
---

# Zippy editor: PHP object injection in versions up to 1.7.0

Zippy, a WordPress editor plugin, deserializes untrusted PHP object data in versions up to 1.7.0. An attacker who can supply that data can cause unintended PHP object behavior on the server, which can lead to code execution depending on the available gadget chains.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-plugin:zippy affected <= 1.7.0 fixed ?

## How to check

- WordPress admin > Plugins: is Zippy installed and active, and is its version 1.7.0 or lower? Or run: wp plugin get zippy --field=version
- Any installed version is affected, as 1.7.0 is the latest release.

## Fix

No fixed version: 1.7.0 is the latest release on wordpress.org and is affected. Remove or deactivate the plugin until the maintainer ships a patch.

## Timeline

- 2026-10-29T16:25:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116865
- 2026-10-29T16:39:16+00:00 analyst — Patchstack (reported by Patchstack researcher, 17 Sep 2026, published 28 Oct) says <=1.7.0 affected, no official patch; wordpress.org shows 1.7.0 is still latest (changelog has no fix for this). Required privilege not legible on page (NVD vector PR:H, so high-privilege). Not verified: Patchstack is a third-party DB. No PoC/exploitation found.

## Documents

- [advisory] Patchstack: Zippy <= 1.7.0 PHP Object Injection https://patchstack.com/database/wordpress/plugin/zippy/vulnerability/wordpress-zippy-plugin-1-7-0-php-object-injection-vulnerability
- [fix] Zippy plugin page and changelog (wordpress.org), latest 1.7.0 https://wordpress.org/plugins/zippy/

## From the sources

Editor PHP Object Injection in Zippy <= 1.7.0 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_