Strong Testimonials: PHP object injection via untrusted data deserialization

Summary

The Strong Testimonials WordPress plugin by WP Chill deserializes untrusted data, which allows PHP object injection (CWE-502) in versions up to and including 3.3.12. An attacker with a low-privilege account, such as a Subscriber, can send crafted input over the network to manipulate how the site processes data on the server. The CVSS base score is 8.8 with high impact on confidentiality, integrity and availability. No known exploitation was reported at the time of research.

Affected

• Strong Testimonials WordPress plugin (WP Chill), versions through 3.3.12
• Earliest affected version: Unknown.
• Required privilege per Patchstack: Subscriber-level account.

Fixed in

• Update to version 3.3.13 or later, as stated in the CVE record and by Patchstack.
• The current WordPress.org release is 3.3.16. Whether it also addresses this CVE is unconfirmed.

Workaround

• Unknown. No vendor workaround was found. Patchstack advises updating immediately; if the update is delayed, restrict account registration and use a WAF or virtual patching service.

Exploitation

• Known exploited: No (CISA SSVC: exploitation none, not automatable).
• Public proof of concept: none found.
• Patchstack rates the issue as high priority and expects exploitation to occur.

Our recommendation

• Update the plugin to version 3.3.13 or later, preferably the current release, and verify the installed version.
• Review user accounts with Subscriber or higher roles on affected sites and remove unneeded accounts.
• Restrict open registration where it is not required.
• Monitor sites for unusual activity and keep the plugin on a regular update cycle.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory: PHP Object Injection in Strong Testimonials patchstack.com
• Vulners: CVE-2026-107436 vulners.com
• WordPress.org: Strong Testimonials plugin wordpress.org
• Strix: CVE-2026-107436 www.strix.ai
• Vulners Patchstack advisory PATCHSTACK:9C6A56969D4FFB82B016E02297658CD7 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:54.