Live › vulnerability › CVE-2026-62010
The Avventure plugin for WordPress, versions up to and including 1.1.12, deserializes attacker-supplied PHP objects without authentication. An attacker who can send a crafted request may be able to run code on the server or read data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Sites running the Avventure plugin at version 1.1.12 or earlier are exposed; the sources do not say which request path or setting is needed. Sites without the plugin are not affected.
No product ranges from the sources yet.
avventure plugin header.1.1.12 (the sources do not name the fixed version).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-62010")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.