CVE-2026-116390: WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything — WordPress & WooCommerce Filters: from n/a through 1.9.7.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
Filter Everything — WordPress & WooCommerce Filters versions through 1.9.7 are affected. The affected version range does not identify a lower bound.
What level of access does an attacker need?
The supplied CVSS vector indicates that an attacker must have high privileges. Exploitation is network-accessible, requires low attack complexity, and does not require user interaction.
What could successful exploitation allow?
The vulnerability is rated high severity with high impacts to confidentiality, integrity, and availability. It is described as PHP object injection caused by deserialization of untrusted data.