GS Pins for Pinterest WordPress plugin: PHP Object Injection

Summary

The GS Pins for Pinterest WordPress plugin up to and including version 1.9.2 contains a deserialization flaw (CWE-502) that allows PHP object injection. An attacker with a logged-in account and low privileges on the network can send crafted data that the site processes as PHP objects, which can lead to manipulation of data and harmful actions on the server. The CVSS score is 8.8, but Patchstack rates the issue as medium priority, and no public exploit or KEV listing was found.

Affected

• GS Pins for Pinterest WordPress plugin (slug gs-pinterest-portfolio) versions up to and including 1.9.2

Fixed in

• Version 1.9.3 or later

Workaround

• Update the plugin to version 1.9.3 or later.
• If an update is not possible, ask your hosting provider or web developer for help.
• If the plugin is not essential, deactivate it until it can be updated.
• Unknown: whether Patchstack's virtual patch covers this issue.

Exploitation

• No evidence of exploitation in the wild found.
• CISA SSVC in the CVE record: exploitation none, automatable no.
• Not listed in CISA KEV.
• No public exploit found.

Our recommendation

• Identify WordPress sites that run this plugin and check for version 1.9.2 or lower.
• Update the plugin to version 1.9.3 or later.
• Review user accounts, especially those with contributor or higher roles, and remove unneeded accounts.
• Check the sites for signs of tampering.
• Check the plugin's WordPress.org changelog for details of the fix.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• OpenCVE CVE-2026-110370 app.opencve.io
• WPScan plugin page wpscan.com
• VulDB entry 424726 vuldb.com
• VulnCheck/Vulnrichment CVE-2026-110370 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:15.