CVE-2026-107436: WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability

Q: What level of access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges (PR:L). The attack can be performed remotely with low complexity and does not require user interaction.

Q: What could successful exploitation allow?

The issue is rated high severity with high impacts to confidentiality, integrity, and availability. Successful object injection could therefore expose data, alter data, or disrupt the affected site.

Q: Which plugin versions are affected?

Strong Testimonials versions through 3.3.12 are affected. The available information does not identify a fixed version.

Published Oct 18, 2026

Updated

Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.

Affected Software

1 affected component

WP Chill Strong Testimonials<=3.3.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Strong Testimonials plugin to a version that resolves this vulnerability.
Fixed in 3.3.13

Event History

Oct 18, 2026

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges (PR:L). The attack can be performed remotely with low complexity and does not require user interaction.

What could successful exploitation allow?