DesignSetGo WordPress plugin: PHP Object Injection

Summary

The DesignSetGo WordPress plugin up to and including version 2.8.0 contains a PHP Object Injection flaw (CWE-502). An attacker with a Contributor-level account can submit crafted serialized data that the plugin processes unsafely. Successful exploitation can allow manipulation of server-side processing and harmful actions on the server, with high impact on confidentiality, integrity and availability. No public proof of concept or confirmed in-the-wild exploitation was found at the time of writing.

Affected

• DesignSetGo WordPress plugin up to and including version 2.8.0

Fixed in

• Patchstack lists version 2.8.1 as the patched version. This is not yet confirmed against the vendor changelog.

Workaround

• No vendor workaround known.
• Review Contributor-level accounts and restrict them to what is required.
• Apply a virtual patch from a WAF or security provider if the plugin cannot be updated quickly.

Exploitation

• CISA SSVC rates exploitation as none and automatable as no.
• Patchstack expects exploitation and reports mass-exploit use of similar vulnerabilities.
• No public proof of concept found.
• Not found in the CISA KEV catalogue during research.

Our recommendation

• Update DesignSetGo to version 2.8.1 or later, after confirming the release in the WordPress.org changelog.
• Review Contributor and other low-privilege accounts and remove unused ones.
• Identify all sites running DesignSetGo and monitor them for unusual activity.
• If an update is not possible immediately, apply a virtual patch.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• Strix CVE record www.strix.ai
• WordPress.org plugin page wordpress.org
• GitHub pull request 638 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:12.