CVE-2026-114704: WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Relevanssi pluginto a version that resolves this vulnerability.Fixed in 4.28.5
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability has a privileges-required rating of High (PR:H), so exploitation requires an attacker to already hold high privileges in the affected WordPress environment.
Which Relevanssi versions are affected?
The affected range is reported as all versions through 4.28.4. No fixed version is provided in the available data.
What is the potential impact if exploitation succeeds?
The supplied severity vector rates confidentiality, integrity, and availability impact as High. Successful object injection could therefore lead to significant compromise of data, site behavior, or service availability.