{"id":"CVE-2026-122662","kind":"vulnerability","aliases":["CVE-2026-122662"],"related":[],"title":"Document Library Pro WordPress plugin: untrusted data deserialization allows object injection","description":"Deserialization of Untrusted Data vulnerability in Barn2 Plugins Document Library Pro document-library-pro allows Object Injection.This issue affects Document Library Pro: from n/a before 4.2.2.","summary":"Document Library Pro, a WordPress plugin from Barn2 Plugins, deserializes untrusted data, which allows PHP object injection. The sources do not say what an attacker can then do, beyond that the flaw is rated critical (CVSS 9.8).","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["document-library-pro","package","php","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `document-library-pro` plugin is installed on your WordPress site and which version it runs.\n- Compare the installed version with the fixed version below.","fix":"- Document Library Pro: move to `4.2.2` or later (the description says the issue affects versions before 4.2.2).","status":"open","published_at":"2026-11-15T14:17:20+00:00","first_seen_at":"2026-11-15T14:36:14+00:00","triaged_at":"2026-11-15T14:37:14+00:00","updated_at":"2026-11-15T14:37:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-15T14:37:14Z","model":"claude-haiku-5-5","output":{"fix":"- Document Library Pro: move to `4.2.2` or later (the description says the issue affects versions before 4.2.2).","reach":"unknown","title":"Document Library Pro WordPress plugin: untrusted data deserialization allows object injection","impact":"high","summary":"Document Library Pro, a WordPress plugin from Barn2 Plugins, deserializes untrusted data, which allows PHP object injection. The sources do not say what an attacker can then do, beyond that the flaw is rated critical (CVSS 9.8).","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","document-library-pro","php"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; object injection may allow code execution, sources do not say","analyst_note":"Confirm the attack preconditions and whether code execution is reachable, using the NVD entry or the vendor advisory.","how_to_check":"- Check whether the `document-library-pro` plugin is installed on your WordPress site and which version it runs.\n- Compare the installed version with the fixed version below.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Document Library Pro WordPress plugin before version 4.2.2 are affected. The sources do not describe further conditions, such as whether login is needed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000715,"input_tokens":4534,"output_tokens":523,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-122662':14A,17A '-2026':13A,16A '4.2.2':88C '9.8':61B 'affect':81C 'allow':9A,38B,77C 'attack':49B 'barn2':32B,68C 'beyond':53B 'critic':59B 'cve':12A,15A 'cvss':60B 'data':7A,36B,65C 'deseri':8A,34B,62C 'document':1A,19B,25B,70C,74C,82C 'document-library-pro':18B,73C 'flaw':56B 'inject':11A,41B 'injection.this':79C 'issu':80C 'librari':2A,20B,26B,71C,75C,83C 'n/a':86C 'object':10A,40B,78C 'packag':22B 'php':23B,39B 'plugin':5A,30B,33B,69C 'pro':3A,21B,27B,72C,76C,84C 'rate':58B 'say':46B 'sourc':43B 'untrust':6A,35B,64C 'vulner':66C 'wordpress':4A,24B,29B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Document Library Pro WordPress plugin before version 4.2.2 are affected. The sources do not describe further conditions, such as whether login is needed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","documentlibrarypro","package","php","wordpress"],"campaign_type":null,"search_a":"'-122662':14A,17A '-2026':13A,16A 'allow':9A 'cve':12A,15A 'data':7A 'deseri':8A 'document':1A 'inject':11A 'librari':2A 'object':10A 'plugin':5A 'pro':3A 'untrust':6A 'wordpress':4A","search_b":"'9.8':61B 'allow':38B 'attack':49B 'barn2':32B 'beyond':53B 'critic':59B 'cvss':60B 'data':36B 'deseri':34B 'document':19B,25B 'document-library-pro':18B 'flaw':56B 'inject':41B 'librari':20B,26B 'object':40B 'packag':22B 'php':23B,39B 'plugin':30B,33B 'pro':21B,27B 'rate':58B 'say':46B 'sourc':43B 'untrust':35B 'wordpress':24B,29B","search_c":"'4.2.2':88C 'affect':81C 'allow':77C 'barn2':68C 'data':65C 'deseri':62C 'document':70C,74C,82C 'document-library-pro':73C 'injection.this':79C 'issu':80C 'librari':71C,75C,83C 'n/a':86C 'object':78C 'plugin':69C 'pro':72C,76C,84C 'untrust':64C 'vulner':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122662","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122662","severity":null,"published_at":"2026-11-15T14:17:20+00:00","modified_at":"2026-11-15T14:17:21+00:00","first_seen_at":"2026-11-15T14:36:14+00:00","fetched_at":"2026-11-15T14:36:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}