CVE-2026-94065

Summary

A deserialization vulnerability in ColorFolio allows attackers to inject malicious objects during data processing, potentially leading to remote code execution or complete system compromise.

Exploitability

Exploitation requires a low-privileged user account and is moderately difficult due to the need for crafting a specific serialized payload, but becomes more feasible with additional attack surface exposure.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on the affected system, potentially leading to full compromise of the WordPress site and access to sensitive data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to ColorFolio version 1.4 or later to remediate this deserialization vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.