Phoenix Media Rename: PHP object injection via untrusted data deserialization

Summary

The WordPress plugin Phoenix Media Rename up to and including version 3.13.5 deserializes untrusted data, which allows PHP object injection (CWE-502). An attacker with low-privileged access, such as a contributor account, can send crafted input to make the site process harmful objects, which can compromise confidentiality, integrity and availability of the website. The CVSS score is 8.8, but Patchstack classifies the priority as medium, and no public proof of concept or known exploitation was found at the time of writing.

Affected

• crossi72 Phoenix Media Rename (WordPress plugin) up to and including 3.13.5
• Earlier versions: Unknown. The CVE record gives the range as "n/a through 3.13.5".

Fixed in

• Patchstack lists version 3.13.6 as the patched version. The vendor changelog did not confirm this at the time of writing.

Workaround

• Deactivate and remove the plugin if its media renaming function is not required.
• Restrict accounts that can reach the plugin's functions and close open self-registration.
• Use a web application firewall or virtual patch if your hosting provider offers one. Patchstack reports a mitigation rule.

Exploitation

• Not known to be exploited in the wild, and no reliable public proof of concept was found.
• The CISA SSVC assessment lists exploitation as none, with automatable set to no and technical impact set to total.
• Patchstack expects exploitation to increase. EPSS is 0.29 % (percentile 21).

Our recommendation

• Check whether the plugin is installed on any WordPress site, including sites that are not in active use.
• Update to version 3.13.6 or later as soon as it can be verified. If no update is available, remove the plugin or apply the mitigations above.
• Review accounts with contributor, author or subscriber roles and remove unneeded accounts.
• Monitor the Patchstack advisory and the WordPress.org plugin page for new releases.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• VulDB entry 428002 vuldb.com
• WordPress.org plugin page wordpress.org
• OffSeq radar record radar.offseq.com
• CVE daily brief (KEV status) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:34.