Paytium WordPress plugin: PHP Object Injection via untrusted data

Summary

The Paytium WordPress plugin up to and including version 5.0.5 deserializes untrusted data, which allows PHP object injection (CWE-502). According to Patchstack, an unauthenticated remote attacker can manipulate how the site processes data and run harmful actions on the server. The CVSS 9.8 score comes from the CNA Patchstack; VulDB rates the issue 7.3, so the severity is contested.

Affected

• Paytium WordPress plugin, versions through 5.0.5

Fixed in

• Version 5.0.6 (per Patchstack; no vendor advisory found, verify on the WordPress.org plugin page)

Workaround

• Patchstack offers a virtual patch for this issue (details not confirmed)
• If an update is not possible at once, ask the hosting provider or web developer for help
• Temporary measures suggested by a secondary source: disable the plugin or use a WAF (unreliable source)

Exploitation

• Not listed in CISA KEV; no confirmed exploitation in the wild known
• Patchstack expects exploitation and mass-campaign use (vendor forecast, not an observed attack)
• Public PoC status is conflicting; no verified PoC found
• CISA SSVC: exploitation none, automatable yes, technical impact total

Our recommendation

• Update Paytium to version 5.0.6 or later on all WordPress sites, including staging and test sites
• Until updated, enable a WAF or virtual patch if available and restrict exposure where possible
• Check affected sites for signs of compromise, such as unknown files or unexpected administrator accounts
• Monitor logs for suspicious requests to the plugin
• Prioritise internet-facing shops and donation pages

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory CVE-2026-114196 patchstack.com
• OpenCVE CVE-2026-114196 app.opencve.io
• VulDB entry 426089 vuldb.com
• TheHackerWire vulnerability page www.thehackerwire.com
• TheHackerWire Paytium analysis www.thehackerwire.com
• Sploitus exploit entry (unverified) sploitus.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:37.