CVE-2026-114196

Summary

The Paytium plugin for WordPress before 5.0.6 contains a deserialization vulnerability (CWE-502) that allows unauthenticated remote attackers to inject arbitrary PHP objects, potentially leading to remote code execution or data manipulation.

Exploitability

Exploitation is straightforward for remote attackers with network access, as it requires only sending a specially crafted serialized payload to a vulnerable endpoint without authentication.

Blast radius

Successful exploitation could lead to full system compromise including unauthorized data access, modification of website content, or execution of arbitrary server-side code.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade Paytium to version 5.0.6 or later, which contains the vendor's official fix for this deserialization vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.