Live › vulnerability › CVE-2026-118074
Finale Lite, a WordPress theme, up to version 2.21.0 has a PHP object injection flaw. A shop manager account can use it to inject serialized PHP objects that may lead to code execution on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Sites running the Finale Lite WordPress theme at version 2.21.0 or earlier. The flaw needs a shop manager account, so exposure depends on who holds that role. Sites on other themes or on newer Finale Lite releases can skip it.
No product ranges from the sources yet.
2.21.0; the sources do not name the exact fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-118074")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.