CVE-2026-66620 HIGH

CVE-2026-66620: WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability

Vendor Derek Herman

Product OptionTree

Weakness CWE-502 · Unsafe deserialization

Published August 18, 2026

Last update August 18, 2026

View on NVD All CVEs

CVSS base score

7.2/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Editor PHP Object Injection in OptionTree <= 2.7.3 versions.

Explanation of Vulnerability in Simple Terms

02Summary

OptionTree versions up to 2.7.3 contain a deserialization vulnerability that allows authenticated administrators to execute arbitrary PHP code on the site. An attacker with admin access can craft malicious serialized data that, when processed by the application, runs their own code with full site privileges. This requires high-level access but poses a critical risk if admin credentials are compromised.

What an attacker can do

03Attacker Capabilities

Run arbitrary PHP code on the site with full administrative privileges.

Potential impact on your site

04Site Impact

A compromised admin account can lead to complete site takeover, data theft, or malware installation.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the site.

Key dates

06Disclosure timeline

August 18, 2026 CVE published

August 18, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-66620 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html AskarLabs — CWE-502 write-up Deserialization of Untrusted Data

Related vulnerabilities