Unverified50% confidenceFactExact time
PHP deserialization vulnerabilities recur in WordPress plugins and Composer packages, rooted in developers' insufficient awareness of object injection risks.
1
Sources
50%
Confidence
Long-term
Relevance
10/21/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedPHP has been disclosed to have two critical-severity security vulnerabilities.71% similarUnverifiedApplication password authentication depends on the site enabling HTTPS; in a pure HTTP environment WordPress will refuse to generate it; some security plugins (such as Wordfence) block the REST API by default or add extra interception to application password authentication, causing requests to fail with error messages pointing in unrelated directions.69% similarUnverifiedPHP's enormous installed base and large number of outdated versions that are not updated in time make the potential spread of such vulnerabilities extremely fast.66% similarUnverifiedPHP2Shell is a publicly disclosed exploit chain that can chain multiple flaws in PHP applications into a complete remote code execution (RCE) path.65% similarUnverified字体解析漏洞和图像解码器漏洞是除JIT之外的高频攻击向量，如FreeType/OpenType解析缺陷及libpng、libjpeg中的堆溢出64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1081090API
curl https://kongchang.com/api/v1/knowledge/claims/1081090MCP
get_claim(id=1081090)