CVE-2026-116389: WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object Injection.This issue affects Phoenix Media Rename: from n/a through 3.13.5.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates that exploitation is network-accessible, requires low privileges, and does not require user interaction. An attacker would need an account or other access level corresponding to low privileges.
What versions are affected?
Phoenix Media Rename versions through 3.13.5 are affected. The available data does not identify a fixed version.
What is the potential impact?
The reported CVSS vector rates confidentiality, integrity, and availability impacts as high. Successful exploitation could therefore affect data confidentiality, alter data or system behavior, and disrupt availability.
Is the default configuration known to be affected?
The provided information does not state whether exploitation requires a non-default configuration or a specific plugin feature to be enabled.