CVE-2026-114196: WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability
Published Oct 24, 2026
·Updated
Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.
Affected Software
1 affected component
Paytium Paytium<=5.0.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Paytium pluginto a version that resolves this vulnerability.Fixed in 5.0.6
Event History
Oct 24, 2026
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Which Paytium installations are affected?
Paytium versions through 5.0.5 are affected. The available data does not identify a fixed version.
2
Does exploitation require authentication or user interaction?
No. The vulnerability is rated AV:N/AC:L/PR:N/UI:N, indicating it can be exploited remotely with low attack complexity, without privileges or user interaction.
3
What is the likely impact if exploitation succeeds?
The severity vector indicates high impact to confidentiality, integrity, and availability. The issue is a PHP object injection caused by deserialization of untrusted data.