---
id: "CVE-2026-122662"
page: "https://infrastack.ai/live/CVE-2026-122662"
kind: "vulnerability"
aliases: ["CVE-2026-122662"]
title: "Document Library Pro WordPress plugin: untrusted data deserialization allows object injection"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["document-library-pro", "package", "php", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-15T14:17:20+00:00"
first_seen_at: "2026-11-15T14:36:14+00:00"
updated_at: "2026-11-15T14:37:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122662", "first_seen_at": "2026-11-15T14:36:14+00:00"}]
exploit_sources: []
---

# Document Library Pro WordPress plugin: untrusted data deserialization allows object injection

Link for people: https://infrastack.ai/live/CVE-2026-122662 (this .md is for agents)

Document Library Pro, a WordPress plugin from Barn2 Plugins, deserializes untrusted data, which allows PHP object injection. The sources do not say what an attacker can then do, beyond that the flaw is rated critical (CVSS 9.8).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `document-library-pro` plugin is installed on your WordPress site and which version it runs.
- Compare the installed version with the fixed version below.

## Fix

- Document Library Pro: move to `4.2.2` or later (the description says the issue affects versions before 4.2.2).

## Timeline

- 2026-11-15T14:36:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122662

## From the sources

Deserialization of Untrusted Data vulnerability in Barn2 Plugins Document Library Pro document-library-pro allows Object Injection.This issue affects Document Library Pro: from n/a before 4.2.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_