Dynamic QR Code – generator: PHP Object Injection in WordPress plugin
Summary
The WordPress plugin Dynamic QR Code – generator by sosidee, versions up to and including 1.0.1, contains a PHP Object Injection vulnerability (CWE-502). An attacker with a Contributor-level account can submit crafted serialized data that the plugin processes, which may allow manipulation of server-side objects. Depending on the other installed plugins and themes, this can lead to code execution, data access or denial of service. The CNA Patchstack rates it CVSS 8.8, and no fixed version has been confirmed.
Affected
- Dynamic QR Code – generator (WordPress plugin, sosidee)
- Versions <= 1.0.1 (VulDB lists 1.0.0 and 1.0.1)
Fixed in
Unknown. No patched version has been confirmed by the vendor or Patchstack. Do not assume that 1.0.1 is safe.
Workaround
- No vendor mitigation found.
- Deactivate and remove the plugin if it is not business-critical.
- Review and restrict accounts with the Contributor role and disable open self-registration.
Exploitation
- No evidence of exploitation in the wild (OffSeq).
- No public proof of concept found (OffSeq, VulDB).
- CISA SSVC: exploitation none, automatable no.
- EPSS 0.37 % (percentile 31). Not listed in CISA KEV.
Our recommendation
- Treat the plugin as unpatched until a fixed version is confirmed.
- If the plugin is not needed, deactivate and remove it.
- If it is needed, restrict or remove Contributor and other low-privilege accounts and disable open registration.
- Check user accounts for unexpected activity and monitor the Patchstack entry and the WordPress.org plugin page for a new release.
- Priority: medium to high for public WordPress sites with several author-level users.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- VulDB entry 428502 vuldb.com
- OffSeq threat radar radar.offseq.com
- GitHub CVE issue 3526 github.com
- CVE threat intelligence mirror cve.threatint.com
- InstaWP plugin page instawp.com
- Strix CVE-2026-116867 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:10.
Original description (NVD)
Contributor PHP Object Injection in Dynamic QR Code – generator <= 1.0.1 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.