{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/wp-chill/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wpchill:strong_testimonials:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-107436"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Strong Testimonials (\u003c= 3.3.12)"],"_cs_severities":["high"],"_cs_tags":["wordpress","vulnerability","deserialization"],"_cs_type":"advisory","_cs_vendors":["WP Chill"],"content_html":"\u003cp\u003eThe Strong Testimonials plugin for WordPress, developed by WP Chill, is vulnerable to an object injection flaw via deserialization of untrusted data. This vulnerability, tracked as CVE-2026-107436, affects all versions of the plugin from inception through 3.3.12. An attacker can exploit this weakness by sending specially crafted serialized data to the application, which the plugin insecurely deserializes. Successful exploitation allows for the instantiation of arbitrary PHP objects, which can be leveraged to execute unauthorized actions or achieve remote code execution (RCE) on the underlying web server. Given the prevalence of WordPress plugins in enterprise environments, this vulnerability poses a significant risk to web infrastructure, allowing attackers to compromise the integrity and confidentiality of the host environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an unauthenticated or authenticated attacker to inject malicious objects, potentially resulting in complete compromise of the WordPress site. As this plugin is widely used for site testimonials, a successful attack could lead to unauthorized database modification, administrative account takeover, or full server-side command execution, depending on the available gadget chains within the site's environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the Strong Testimonials plugin to a version beyond 3.3.12 to mitigate the vulnerability described in CVE-2026-107436.\u003c/li\u003e\n\u003cli\u003eAudit WordPress installations for the presence of the affected plugin version using site inventory tools.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious POST requests targeting WordPress plugin directory paths, particularly those involving unusual serialized data patterns.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-18T11:52:21Z","date_published":"2026-10-18T11:52:21Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-107436/","summary":"A deserialization of untrusted data vulnerability (CVE-2026-107436) in the WP Chill Strong Testimonials plugin allows remote attackers to perform object injection, potentially leading to remote code execution.","title":"Deserialization Vulnerability in WP Chill Strong Testimonials","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-107436/"}],"language":"en","title":"CraftedSignal Threat Feed - WP Chill","version":"https://jsonfeed.org/version/1.1"}