{"id":"CVE-2026-116867","kind":"vulnerability","aliases":["CVE-2026-116867"],"related":[],"title":"WordPress QR code plugin: PHP object injection lets contributors run code","description":"Contributor PHP Object Injection in Dynamic QR Code &#8211; generator <= 1.0.1 versions.","summary":"The Dynamic QR Code generator WordPress plugin, versions 1.0.1 and earlier, has a PHP object injection flaw. A contributor-level WordPress user can supply serialized data that the plugin unserializes, which can lead to code execution on the server.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug>` if WP-CLI is available.\n- Confirm whether any untrusted users hold the Contributor role or higher.","fix":"- Dynamic QR Code generator: unknown (sources do not state a fixed version)","status":"open","published_at":"2026-10-29T16:18:01+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","triaged_at":"2026-10-29T16:28:09+00:00","updated_at":"2026-10-29T16:28:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:28:09Z","model":"claude-haiku-5-5","output":{"fix":"- Dynamic QR Code generator: unknown (sources do not state a fixed version)","reach":"internet","title":"WordPress QR code plugin: PHP object injection lets contributors run code","impact":"high","summary":"The Dynamic QR Code generator WordPress plugin, versions 1.0.1 and earlier, has a PHP object injection flaw. A contributor-level WordPress user can supply serialized data that the plugin unserializes, which can lead to code execution on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","php","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs on the web server via injected objects","analyst_note":"Confirm the fixed plugin version and the vulnerable code path at https://nvd.nist.gov/vuln/detail/CVE-2026-116867 and the plugin's WordPress.org changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug>` if WP-CLI is available.\n- Confirm whether any untrusted users hold the Contributor role or higher.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-contributor-accounts"],"who_is_affected":"Sites running the Dynamic QR Code generator WordPress plugin at version 1.0.1 or earlier are exposed. Exploitation needs an account with at least Contributor rights, so sites with only trusted editors and administrators are lower risk. Sites without this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000709,"input_tokens":4068,"output_tokens":605,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116867':14A,17A '-2026':13A,16A '1.0.1':32B,73C 'code':3A,11A,27B,59B,71C 'contributor':9A,43B,64C 'contributor-level':42B 'cve':12A,15A 'data':50B 'dynam':25B,69C 'earlier':34B 'execut':60B 'flaw':40B 'generat':28B,72C 'host':22B 'inject':7A,39B,67C 'lead':57B 'let':8A 'level':44B 'object':6A,38B,66C 'packag':18B 'php':5A,19B,37B,65C 'plugin':4A,30B,53B 'qr':2A,26B,70C 'run':10A 'self':21B 'self-host':20B 'serial':49B 'server':63B 'suppli':48B 'unseri':54B 'user':46B 'version':31B,74C 'wordpress':1A,23B,29B,45B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Dynamic QR Code generator WordPress plugin at version 1.0.1 or earlier are exposed. Exploitation needs an account with at least Contributor rights, so sites with only trusted editors and administrators are lower risk. Sites without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116867","severity":null,"published_at":"2026-10-29T16:18:01+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","fetched_at":"2026-10-29T16:25:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}