SEO Plugin by Squirrly SEO: PHP Object Injection
Summary
Versions up to and including 14.2.5 of the WordPress plugin SEO Plugin by Squirrly SEO contain a PHP Object Injection vulnerability (CWE-502). An authenticated user with Contributor rights can submit crafted serialized data that the plugin processes unsafely. Depending on the code paths and other installed components, this can lead to code execution, data manipulation or denial of service on the web server.
Affected
- SEO Plugin by Squirrly SEO (WordPress plugin, slug squirrly-seo) up to and including 14.2.5
- Attack requires a Contributor-level WordPress account
Fixed in
- Version 14.2.6 or later (according to the CVE record and Patchstack)
Workaround
- Unknown. No vendor-published workaround was found.
- Restrict or remove Contributor-level accounts that are not needed until the plugin is updated.
Exploitation
- No confirmed in-the-wild exploitation known.
- CISA SSVC: exploitation none, not automatable.
- Patchstack rates the issue as medium priority and expects exploitation.
Our recommendation
- Update the plugin to version 14.2.6 or later immediately.
- Review and remove unused Contributor or higher accounts and check who can register on the site.
- Check the site for other outdated WordPress plugins and themes.
- Monitor the site for unexpected plugin changes and unusual activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory for CVE-2026-94076 patchstack.com
- Patchstack vulnerability history for squirrly-seo patchstack.com
- WordPress.org plugin page for squirrly-seo wordpress.org
- Strix CVE record for CVE-2026-94076 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:13.
Original description (NVD)
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.