CVE-2026-105885

Summary

The 10Web Slider plugin has a deserialization vulnerability that allows untrusted data to be injected into objects during processing, potentially leading to remote code execution or data compromise.

Exploitability

Exploitation requires a low-privileged user to submit malicious serialized data, which is then deserialized without proper validation, making it moderately difficult to exploit but possible with user interaction.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on the affected WordPress site, potentially leading to full compromise of the web application and access to sensitive data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.2.63 or later to remediate this deserialization vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.