---
id: "CVE-2026-54856"
kind: "vulnerability"
aliases: ["CVE-2026-54856"]
title: "RexCoin WordPress plugin: unauthenticated PHP object injection up to 1.2.6"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "php", "rexcoin", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-29T16:18:09+00:00"
first_seen_at: "2026-10-29T16:25:59+00:00"
updated_at: "2026-10-29T16:27:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54856", "first_seen_at": "2026-10-29T16:25:59+00:00"}]
---

# RexCoin WordPress plugin: unauthenticated PHP object injection up to 1.2.6

RexCoin versions 1.2.6 and earlier contain a PHP object injection flaw that an unauthenticated request can trigger. Successful exploitation can let an attacker run code or control application logic on the server, according to the NVD record's CVSS 9.8 critical score.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed RexCoin version in the plugin list or plugin directory; versions `1.2.6` and below are listed as affected.

## Fix

- RexCoin: unknown; the sources do not name a fixed version.

## Timeline

- 2026-10-29T16:25:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54856

## From the sources

Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_