Description

Editor PHP Object Injection in OptionTree <= 2.7.3 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-18T15:16:57.153Z",
  "pubdate": "2026-08-18T15:16:57.153Z",
  "executiveSummary": "An object injection vulnerability has been identified in the OptionTree plugin, affecting versions 2.7.3 and prior. This security flaw stems from the insecure handling of serialized data, allowing remote attackers to manipulate input parameters and instantiate arbitrary PHP objects within the application scope.\nThe primary impact of this vulnerability includes potential remote code execution, arbitrary file deletion, or sensitive data disclosure, depending on the availability of compatible gadget chains within the application environment. The affected systems encompass WordPress installations utilizing vulnerable versions of the OptionTree plugin.\nExploitation of this vulnerability requires an attacker to interact with the vulnerable component by supplying a crafted serialized payload via HTTP requests. Risk implications are critical, as successful exploitation could lead to full compromise of the underlying web server hosting the affected WordPress instance. Mitigation requires updating the OptionTree plugin beyond version 2.7.3 or applying appropriate input sanitization and deserialization controls.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper handling and deserialization of untrusted user input within the OptionTree plugin. Specifically, versions 2.7.3 and below inadequately validate or sanitize data prior to passing it to native PHP deserialization functions such as unserialize().\nThe attack flow begins when an unauthenticated or authenticated remote attacker crafts a malicious serialized PHP object payload designed to leverage existing classes, methods, and magic methods—such as __destruct() or __wakeup()—within the application or its dependent libraries. The attacker submits this payload via HTTP parameters targeting the vulnerable component in OptionTree.\nUpon receiving the input, the application processes the request and executes the insecure deserialization routine. This instantiates the malicious object specified in the payload and triggers execution routines defined within the object's magic methods. Depending on the loaded classes, the attacker can construct gadget chains to achieve arbitrary code execution, interact with the local file system, or execute database queries.\nThe vulnerable component resides within the core processing routines of OptionTree versions 2.7.3 and earlier. Network exposure is broad, as the attack vector is accessible over standard HTTP/HTTPS protocols via web requests directed at the WordPress site. Privilege requirements depend on the specific endpoint exposed by the plugin, but potential vulnerabilities in administrative or AJAX handlers can sometimes be leveraged by lower-privileged users or unauthenticated attackers."
}