CVE-2026-112857

Summary

The Reprizo plugin before 1.0.8 for WordPress suffers from a PHP object injection vulnerability (CWE-502) due to unsafe deserialization of user-supplied data, which could allow an unauthenticated attacker to execute arbitrary code or perform other harmful actions by injecting malicious serialized objects.

Exploitability

Exploitation is straightforward for an unauthenticated remote attacker since no authentication, user interaction, or special conditions are required (CVSS vector AV:N/AC:L/PR:N/UI:N).

Blast radius

Successful exploitation could lead to full system compromise including remote code execution, data exfiltration, and service disruption on the affected WordPress site.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Reprizo version 1.0.9 or later, which contains a fix for the deserialization vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.