{"id":"CVE-2026-118074","kind":"vulnerability","aliases":["CVE-2026-118074"],"related":[],"title":"Finale Lite WordPress theme: PHP object injection lets shop managers run code","description":"Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.","summary":"Finale Lite, a WordPress theme, up to version 2.21.0 has a PHP object injection flaw. A shop manager account can use it to inject serialized PHP objects that may lead to code execution on the site.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["finale-lite","other","woocommerce","wordpress"],"not_affected_if":["newer-theme-version","no-shop-manager-users"],"how_to_check":"- Check the installed Finale Lite theme version in WordPress under Appearance > Themes, or read the theme's style.css header.\n- Confirm whether any user holds the shop manager role.","fix":"- Move to a Finale Lite release newer than `2.21.0`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-10-29T16:18:02+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","triaged_at":"2026-10-29T16:29:48+00:00","updated_at":"2026-10-29T16:29:48+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-29T16:29:48Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Finale Lite release newer than `2.21.0`; the sources do not name the exact fixed version.","reach":"internet","title":"Finale Lite WordPress theme: PHP object injection lets shop managers run code","impact":"high","summary":"Finale Lite, a WordPress theme, up to version 2.21.0 has a PHP object injection flaw. A shop manager account can use it to inject serialized PHP objects that may lead to code execution on the site.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","finale-lite","woocommerce"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker with shop manager access can execute code on the server","analyst_note":"Confirm the fixed Finale Lite version and the exact injection sink at https://nvd.nist.gov/vuln/detail/CVE-2026-118074 and the theme vendor's changelog.","how_to_check":"- Check the installed Finale Lite theme version in WordPress under Appearance > Themes, or read the theme's style.css header.\n- Confirm whether any user holds the shop manager role.","plain_action":"","needs_analyst":true,"not_affected_if":["newer-theme-version","no-shop-manager-users"],"who_is_affected":"Sites running the Finale Lite WordPress theme at version 2.21.0 or earlier. The flaw needs a shop manager account, so exposure depends on who holds that role. Sites on other themes or on newer Finale Lite releases can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000693,"input_tokens":4050,"output_tokens":576,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118074':15A,18A '-2026':14A,17A '2.21.0':33B,69C 'account':43B 'code':12A,56B 'cve':13A,16A 'execut':57B 'final':1A,20B,25B,67C 'finale-lit':19B 'flaw':39B 'inject':7A,38B,48B,65C 'lead':54B 'let':8A 'lite':2A,21B,26B,68C 'manag':10A,42B,62C 'may':53B 'object':6A,37B,51B,64C 'php':5A,36B,50B,63C 'run':11A 'serial':49B 'shop':9A,41B,61C 'site':60B 'theme':4A,29B 'use':45B 'version':32B,70C 'woocommerc':23B 'wordpress':3A,24B,28B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Finale Lite WordPress theme at version 2.21.0 or earlier. The flaw needs a shop manager account, so exposure depends on who holds that role. Sites on other themes or on newer Finale Lite releases can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118074","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118074","severity":null,"published_at":"2026-10-29T16:18:02+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","fetched_at":"2026-10-29T16:25:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}