Advanced Post Manager: PHP object injection

Summary

Advanced Post Manager, a WordPress plugin by StellarWP (Liquid Web), contains a deserialization flaw (CWE-502) that allows PHP object injection. According to the CNA, an attacker can manipulate data processed by the plugin to run harmful actions on the server, with a CVSS score of 9.8. Sources conflict on whether authentication is required; one source describes an authenticated Contributor attack with CVSS 6.6, so plan for the worse case.

Affected

• Advanced Post Manager WordPress plugin, versions up to and including 4.5.5

Fixed in

• Version 4.5.6 is named as the patched version in the CVE record and by Patchstack.
• Version 4.5.7 is the latest release on WordPress.org and is the recommended target. The vendor advisory confirming 4.5.7 for this CVE could not be reached.

Workaround

• No vendor workaround confirmed.
• Deactivate and remove the plugin if it is not needed.
• Restrict access to the WordPress admin area and review admin and contributor accounts.

Exploitation

• No confirmed exploitation in the wild; not listed in CISA KEV.
• CISA SSVC marks it as automatable with total technical impact. This is a scoring judgement, not evidence of exploitation.
• No public proof of concept found in the research; this may change.

Our recommendation

• Update the plugin to version 4.5.7 (at least 4.5.6) on every WordPress site where it is installed.
• Check whether the plugin is installed and which version is active; remove it if unused.
• Review admin and contributor accounts and monitor for unexpected changes.
• Prioritise internet-facing sites with open contributor registration.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• CVE record JSON (CVE Program / cvelistV5) raw.githubusercontent.com
• WordPress.org plugin page (changelog) wordpress.org
• WPScan plugin entry wpscan.com
• Patchstack plugin vulnerabilities patchstack.com
• Strix CVE page www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:13.