CVE-2026-54858

Summary

The Printy plugin for WordPress versions <= 1.13.0 contains an unauthenticated PHP object injection vulnerability (CWE-502), allowing attackers to deserialize arbitrary objects without authentication, potentially leading to remote code execution or data manipulation.

Exploitability

Exploitation is straightforward for remote attackers due to the lack of authentication requirements and low attack complexity.

Blast radius

Successful exploitation could lead to full system compromise including confidentiality, integrity, and availability impacts across any WordPress site using the vulnerable Printy plugin.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Printy version 1.13.1 or later, which contains the official fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.