{"id":"CVE-2026-118081","kind":"vulnerability","aliases":["CVE-2026-118081"],"related":[],"title":"10Web Social Photo Feed WordPress plugin: PHP object injection by contributors","description":"Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.","summary":"The 10Web Social Photo Feed WordPress plugin, versions 1.5.6 and earlier, has a PHP object injection flaw that a contributor-level user can trigger. Successful exploitation can let an attacker run code or manipulate data on the site, depending on available gadget classes.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["10web-social-photo-feed","package","wordpress"],"not_affected_if":["no-contributor-users","plugin-not-installed"],"how_to_check":"- Check the installed version of the 10Web Social Photo Feed plugin in the WordPress admin under Plugins.\n- Confirm whether any user accounts hold the Contributor role.","fix":"- Move the 10Web Social Photo Feed plugin to a version later than `1.5.6`; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-10-29T16:18:02+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","triaged_at":"2026-10-29T16:28:01+00:00","updated_at":"2026-10-29T16:28:01+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T16:28:01Z","model":"claude-haiku-5-5","output":{"fix":"- Move the 10Web Social Photo Feed plugin to a version later than `1.5.6`; the exact fixed version is unknown from the sources.","reach":"network","title":"10Web Social Photo Feed WordPress plugin: PHP object injection by contributors","impact":"high","summary":"The 10Web Social Photo Feed WordPress plugin, versions 1.5.6 and earlier, has a PHP object injection flaw that a contributor-level user can trigger. Successful exploitation can let an attacker run code or manipulate data on the site, depending on available gadget classes.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","10web-social-photo-feed"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Contributor-level user can inject PHP objects, possibly running code","analyst_note":"Confirm the fixed plugin version and exploitation details from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118081.","how_to_check":"- Check the installed version of the 10Web Social Photo Feed plugin in the WordPress admin under Plugins.\n- Confirm whether any user accounts hold the Contributor role.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-contributor-users"],"who_is_affected":"Sites running the 10Web Social Photo Feed WordPress plugin at version 1.5.6 or earlier where users with Contributor access exist. Sites without the plugin, or with it updated past 1.5.6, are not affected per the description.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000707,"input_tokens":4060,"output_tokens":602,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118081':14A,17A '-2026':13A,16A '1.5.6':33B,78C '10web':1A,19B,26B,74C '10web-social-photo-feed':18B 'attack':55B 'avail':66B 'class':68B 'code':57B 'contributor':11A,45B,69C 'contributor-level':44B 'cve':12A,15A 'data':60B 'depend':64B 'earlier':35B 'exploit':51B 'feed':4A,22B,29B,77C 'flaw':41B 'gadget':67B 'inject':9A,40B,72C 'let':53B 'level':46B 'manipul':59B 'object':8A,39B,71C 'packag':23B 'photo':3A,21B,28B,76C 'php':7A,38B,70C 'plugin':6A,31B 'run':56B 'site':63B 'social':2A,20B,27B,75C 'success':50B 'trigger':49B 'user':47B 'version':32B,79C 'wordpress':5A,24B,30B","nicknames":[],"mitigations":[],"who_affected":"Sites running the 10Web Social Photo Feed WordPress plugin at version 1.5.6 or earlier where users with Contributor access exist. Sites without the plugin, or with it updated past 1.5.6, are not affected per the description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118081","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118081","severity":null,"published_at":"2026-10-29T16:18:02+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","fetched_at":"2026-10-29T16:25:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}