String Locator WordPress plugin: Unauthenticated PHP object injection via database editor
Summary
The String Locator WordPress plugin before version 2.6.8 does not restrict which classes may be instantiated when it deserializes database row content saved through its database editor. An unauthenticated attacker can store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable gadget chain is present through another installed String Locator plugin version before 2.6.8, the impact can extend to arbitrary file deletion, sensitive data disclosure or remote code execution.
Affected
- String Locator WordPress plugin, all versions before 2.6.8 (CNA record: versions 0 to below 2.6.8)
- Version 2.6.7 and earlier are affected, including 2.6.7 which fixed the unrelated CVE-2024-10936
Fixed in
- Version 2.6.8 (WordPress.org changelog dated 2026-09-24, entry 'Security: hardened serialized data processing'). The vendor does not name the CVE in the changelog.
Workaround
- The CVE record provides no workaround.
- Deactivate or remove the plugin if it is not needed and cannot be updated immediately.
- Restrict who can use the plugin's database editor.
- Check plugin-managed database rows for unexpected serialized content.
Exploitation
- Exploitation in the wild: no evidence found. Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Public proof of concept: unknown, not confirmed.
- User interaction is required: an administrator must open and save the affected row.
- EPSS values differ between sources but are low.
Our recommendation
- Update String Locator to version 2.6.8 as a priority wherever the plugin is installed.
- Check whether the plugin is installed on any WordPress site, and whether any site still runs 2.6.7 or older.
- Deactivate the plugin where it is not required.
- Limit administrator accounts and review who uses the database editor.
- Monitor database rows managed by the plugin for unexpected serialized data.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record wpscan.com
- WordPress.org plugin page (changelog) wordpress.org
- GitHub release 2.6.8 github.com
- OpenCVE CVE record app.opencve.io
- VulDB entry vuldb.com
- Wordfence threat intel (related plugin issue) www.wordfence.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:26.
Original description (NVD)
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present via another installed String locator WordPress plugin before 2.6.8 or , this can lead to arbitrary file deletion, sensitive data disclosure or remote code execution.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.