CVE-2026-97188
String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present via another installed String locator WordPress plugin before 2.6.8 or , this can lead to arbitrary file deletion, sensitive data disclosure or remote code execution.
| Vendor | unknown |
| Product | string locator |
| Published | Oct 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown string locator
Be the first to know when new unknown vulnerabilities affecting unknown string locator are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / String locator
0 < 2.6.8
References
Credits
Raphael P. Cigana WPScan