Go Live Update Urls WordPress plugin: PHP Object Injection
Summary
The Go Live Update Urls WordPress plugin up to and including 7.0.8 contains a PHP Object Injection flaw (CWE-502). An attacker with a Contributor-level account can submit crafted serialized data that the plugin processes unsafely. Whether this leads to file deletion, data disclosure or code execution depends on other plugins or themes on the site that provide a usable POP chain, and no such chain is known in this plugin itself.
Affected
- Go Live Update Urls plugin for WordPress, all versions up to and including 7.0.8.
Fixed in
- Update to version 7.1.0 or later (Patchstack, WPScan).
Workaround
- No vendor workaround documented.
- If patching is delayed, deactivate and remove the plugin when it is not needed.
- Review Contributor and higher accounts and remove unused ones.
Exploitation
- Requires an authenticated Contributor-level account.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No known exploitation in the wild found; not listed in CISA KEV according to a third-party aggregator.
- No public proof of concept found in our research.
- Patchstack rates the flaw as medium priority and expects exploitation; Qualys published a scanner detection in October 2026.
Our recommendation
- Inventory WordPress sites with this plugin and confirm the installed version.
- Update to 7.1.0 or later.
- Remove the plugin where it is no longer required, for example after a site migration.
- Limit Contributor and higher roles to trusted users and review accounts regularly.
- Prioritise multi-author sites and sites with external authors.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack vulnerability entry patchstack.com
- WPScan vulnerability entry wpscan.com
- Strix CVE record www.strix.ai
- Qualys detections October 2026 notifications.qualys.com
- Go Live Update Urls changelog onpointplugins.com
- WordPress.org plugin page wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:11.
Original description (NVD)
Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.