Nested Pages WordPress plugin: PHP Object Injection by Contributor users
Summary
The WordPress plugin Nested Pages up to and including version 3.3.2 contains a PHP Object Injection flaw (CWE-502) that is triggered by untrusted data. According to the CVE description, an attacker with a Contributor account can exploit it, which could allow manipulation of how the site processes data and harmful actions on the server. The CVSS score of 9.8 assumes a worst-case scenario, and the actual exposure depends on gadget chains in other installed plugins or themes, which are unknown.
Affected
- Nested Pages (WordPress plugin, slug wp-nested-pages) versions 3.3.2 and earlier
- Required privilege per description: Contributor (CVSS vector states no privileges required, unresolved)
Fixed in
- Version 3.3.3 (per Patchstack and the vendor's release notes; the release notes do not name the CVE)
Workaround
- No vendor-documented workaround found.
- Remove or downgrade Contributor-level accounts that are not needed.
- Enforce strong passwords and MFA on all WordPress accounts.
- Remove the plugin if it is not essential.
Exploitation
- CISA KEV: not listed.
- Patchstack rates it medium priority and expects exploitation; CISA SSVC lists exploitation as none.
- Public proof of concept: none found.
- EPSS: unknown.
Our recommendation
- Update Nested Pages to version 3.3.3 or later on all sites, including staging.
- Review user accounts with Contributor or higher roles.
- Check the plugin version across your inventory and monitor for exploitation attempts.
- Confirm the fix against the Patchstack advisory before closing the ticket.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- Hook & Filter Nested Pages releases github.com
- GitHub Advisory GHSA-vvmp-qqcf-xwvf github.com
- WordPress.org plugin listing wordpress.org
- Strix AI CVE-2026-100512 www.strix.ai
- HOL Guard CVE-2026-100512 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:47.
Original description (NVD)
Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.