{"id":"CVE-2026-10035","title":"The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbp_set_to_serialized_values() function (reached t…","summary":"The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbp_set_to_serialized_values() function (reached t…","severity":"medium","cvss":6.6,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-502"],"published":"2026-08-16","updated":"2026-08-16","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10035","references":[{"url":"https://plugins.trac.wordpress.org/browser/weaver-for-bbpress/tags/1.7.1/includes/wvrbbp-admin-lib.php#L112","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/weaver-for-bbpress/tags/1.7.1/includes/wvrbbp-admin-lib.php#L132","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/weaver-for-bbpress/tags/1.7.1/includes/wvrbbp-admin-top.php#L142","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3633471%40weaver-for-bbpress&new=3633471%40weaver-for-bbpress","label":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e7411ab-174e-4bc2-9f96-dbce925a21eb?source=cve","label":"security@wordfence.com"}],"tags":["nvd"],"epss":0.00389,"epssPercentile":0.32874,"ingestedAt":"2026-08-16T16:39:21.627Z","slug":"CVE-2026-10035","body":"## Overview\n\nThe Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbp_set_to_serialized_values() function (reached through the wvrbbp_save_restore() settings-restore handler). The function reads the raw contents of an administrator-uploaded file and passes them directly to unserialize() without any validation. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin itself; however, if a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":36.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}