漏洞关键信息 描述 The plugin unserializes user input via ajax actions, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog. 影响的插件 wp-e-commerce: No known fix 参考 CVE: CVE-2026-1235 分类 类型: OBJECT INJECTION OWASP Top 10: A8: Insecure Deserialization CWE: CWE-502 CVSS: 6.5 (medium) 杂项信息 原始研究员: yiğit ibrahim sağlam 提交者: yiğit ibrahim sağlam 提交者网站: https://ibrahimsql.com 提交者Twitter: ibrahimsq1 已验证: Yes WPVDB ID: c7eb234e-3113-40db-a00d-358604d91e3f 时间线 公开发布: 2026-01-21 (约21天前) 添加: 2026-01-21 (约20天前) 上次更新: 2026-01-21 (约20天前) 其他 2025-09-22: Translate WordPress with ConveyThis < 269.2 - Admin+ PHP Object Injection 2025-07-11: URL Shortener <= 3.0.7 - Unauthenticated PHP Object Injection 2025-01-03: PlainInventory < 3.1.7 - Unauthenticated PHP Object Injection 2026-01-22: Eventin <= 4.1.1 - Authenticated (Contributor+) PHP Object Injection 2023-11-13: Image Compressor & Optimizer - iLoveIMG < 1.0.6 - Admin+ PHP Object Injection