Deserialization Vulnerability in WP Chill Strong Testimonials

The Strong Testimonials plugin for WordPress, developed by WP Chill, is vulnerable to an object injection flaw via deserialization of untrusted data. This vulnerability, tracked as CVE-2026-107436, affects all versions of the plugin from inception through 3.3.12. An attacker can exploit this weakness by sending specially crafted serialized data to the application, which the plugin insecurely deserializes. Successful exploitation allows for the instantiation of arbitrary PHP objects, which can be leveraged to execute unauthorized actions or achieve remote code execution (RCE) on the underlying web server. Given the prevalence of WordPress plugins in enterprise environments, this vulnerability poses a significant risk to web infrastructure, allowing attackers to compromise the integrity and confidentiality of the host environment.

Impact

The vulnerability allows an unauthenticated or authenticated attacker to inject malicious objects, potentially resulting in complete compromise of the WordPress site. As this plugin is widely used for site testimonials, a successful attack could lead to unauthorized database modification, administrative account takeover, or full server-side command execution, depending on the available gadget chains within the site's environment.

Recommendation

• Immediately update the Strong Testimonials plugin to a version beyond 3.3.12 to mitigate the vulnerability described in CVE-2026-107436.
• Audit WordPress installations for the presence of the affected plugin version using site inventory tools.
• Monitor web server logs for suspicious POST requests targeting WordPress plugin directory paths, particularly those involving unusual serialized data patterns.