{"id":"CVE-2026-54856","kind":"vulnerability","aliases":["CVE-2026-54856"],"related":[],"title":"RexCoin WordPress plugin: unauthenticated PHP object injection up to 1.2.6","description":"Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.","summary":"RexCoin versions 1.2.6 and earlier contain a PHP object injection flaw that an unauthenticated request can trigger. Successful exploitation can let an attacker run code or control application logic on the server, according to the NVD record's CVSS 9.8 critical score.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","php","rexcoin","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed RexCoin version in the plugin list or plugin directory; versions `1.2.6` and below are listed as affected.","fix":"- RexCoin: unknown; the sources do not name a fixed version.","status":"open","published_at":"2026-10-29T16:18:09+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","triaged_at":"2026-10-29T16:27:40+00:00","updated_at":"2026-10-29T16:27:40+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-29T16:27:40Z","model":"claude-haiku-5-5","output":{"fix":"- RexCoin: unknown; the sources do not name a fixed version.","reach":"internet","title":"RexCoin WordPress plugin: unauthenticated PHP object injection up to 1.2.6","impact":"high","summary":"RexCoin versions 1.2.6 and earlier contain a PHP object injection flaw that an unauthenticated request can trigger. Successful exploitation can let an attacker run code or control application logic on the server, according to the NVD record's CVSS 9.8 critical score.","audience":"businesses","category":"other","nicknames":[],"who_cares":["rexcoin","wordpress","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code or alters application logic on the server","analyst_note":"Confirm the affected component, vulnerable endpoint, and whether a fixed RexCoin version exists, using the NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-54856) and the plugin vendor's changelog.","how_to_check":"- Check the installed RexCoin version in the plugin list or plugin directory; versions `1.2.6` and below are listed as affected.\n- unknown for further checks: the sources do not describe the vulnerable code path or endpoint.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the RexCoin plugin at version 1.2.6 or earlier are in scope. The sources do not name the vulnerable endpoint or whether a default configuration is exposed, so teams running RexCoin should treat any installed copy as potentially affected until the vendor or NVD states otherwise.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000716,"input_tokens":4053,"output_tokens":622,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-54856':13A,16A '1.2.6':10A,23B,69C '9.8':60B 'accord':53B 'applic':48B 'attack':43B 'code':45B 'contain':26B 'control':47B 'critic':61B 'cve':11A,14A 'cvss':59B 'earlier':25B 'exploit':39B 'flaw':31B 'inject':7A,30B,66C 'let':41B 'logic':49B 'nvd':56B 'object':6A,29B,65C 'php':5A,18B,28B,64C 'plugin':3A 'record':57B 'request':35B 'rexcoin':1A,19B,21B,68C 'run':44B 'score':62B 'server':52B 'success':38B 'trigger':37B 'unauthent':4A,34B,63C 'version':22B,70C 'wordpress':2A,20B","nicknames":[],"mitigations":[],"who_affected":"Sites running the RexCoin plugin at version 1.2.6 or earlier are in scope. The sources do not name the vulnerable endpoint or whether a default configuration is exposed, so teams running RexCoin should treat any installed copy as potentially affected until the vendor or NVD states otherwise.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54856","severity":null,"published_at":"2026-10-29T16:18:09+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","fetched_at":"2026-10-29T16:25:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}