CVE-2026-1542

Super Stage WP <= 1.0.1 - Unauthenticated PHP Object Injection

Medium · published February 28, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
9.5
In the wild
Unconfirmed
What it is

The Super Stage WP WordPress plugin through 1.0.1 unserializes user input via REQUEST, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00201 · 9.5th percentile
Published
2026-02-28T06:00Z
EPSS history
Timeline
  • 28 FEB 06:00Z
    Super Stage WP <= 1.0.1 - Unauthenticated PHP Object Injection
    cvelistv5