CVE-2026-66565

Summary

A PHP object injection vulnerability in FC United plugin versions 1.1.1 and earlier allows unauthenticated attackers to inject arbitrary PHP objects, leading to potential remote code execution or data compromise.

Exploitability

Exploitation is relatively straightforward as it requires no authentication and can be triggered via a crafted HTTP request, though the specific impact depends on the application's configuration and available classes for deserialization.

Blast radius

The vulnerability could affect any WordPress site running the FC United plugin version 1.1.1 or earlier, potentially allowing attackers to execute arbitrary code, steal sensitive data, or take full control of affected sites.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to FC United plugin version 1.1.2 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.