GS Plugins Team Members: PHP Object Injection via untrusted data deserialization

Summary

The WordPress plugin Team Members – GS Plugins (gs-team-members) up to and including version 2.8.2 deserializes untrusted data, which allows PHP object injection. An authenticated attacker with a low-privilege account, such as a contributor, may be able to manipulate how the site processes data and run harmful actions on the server. Patchstack expects exploitation, but no observed attacks or public proof of concept are known.

Affected

• Team Members – GS Plugins (WordPress plugin, slug gs-team-members) versions up to and including 2.8.2
• Version ranges differ between sources; the CVE text reads "from n/a through 2.8.2"

Fixed in

• Version 2.8.3 or later (according to Patchstack). GS Plugins has not been confirmed as publishing this fix; verify availability on wordpress.org or the vendor site before rollout.

Workaround

• Patchstack advises updating; if that is not possible, ask your hosting provider or web developer for help.
• No vendor or researcher workaround was found.
• If the plugin is not needed, deactivate and remove it.
• Restrict user self-registration and review low-privilege accounts.

Exploitation

• Not listed in CISA KEV. CISA SSVC lists exploitation as none and automatable as no.
• Patchstack expects exploitation; this is a forecast, not an observed attack.
• No public proof of concept found; VulDB states no exploit is available.
• Severity ratings differ: CVSS 8.8 from CNA data, VulDB base 6.3.

Our recommendation

• Check whether the plugin is installed on any WordPress site, especially internet-facing ones.
• Update to version 2.8.3 or later after confirming it is available from wordpress.org or the vendor.
• If an update is not possible right away, remove or deactivate the plugin and restrict self-registration.
• Review contributor and other low-privilege accounts and monitor web server logs for suspicious requests.
• Check whether other GS Plugins products are installed, as a related deserialization issue (CVE-2026-110370) was published the same day.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• wordpress.org plugin page wordpress.org
• VulnCheck/Vulners VULNRICHMENT entry vulners.com
• VulDB entry vuldb.com
• OpenCVE entry app.opencve.io
• Strix CVE entry www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:15.