CVE-2026-57621: WordPress Booktics plugin <= 1.0.21 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is an unauthenticated vulnerability in the Booktics WordPress plugin (versions 1.0.21 and earlier), reachable over the network without any credentials. An attacker sends a crafted serialized PHP payload to a vulnerable endpoint, which the plugin deserializes without validation. Successful exploitation gives the attacker full read, write, and availability impact on the affected WordPress installation, including potential remote code execution depending on available PHP classes. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker can reach it from the internet without any prior foothold on the host.

• AuthenticationNot required

  No credentials of any kind are needed; the injection can be triggered by an anonymous, unauthenticated HTTP request.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user of the WordPress site.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory layout, or any other variable environmental factor.

Blast Radius

• The attacker can read all data accessible to the WordPress process, including database credentials, session tokens, and stored user records.
• The attacker can write or modify files and database content, enabling defacement, backdoor implantation, or privilege escalation within the application.
• The attacker can crash or otherwise deny availability of the WordPress service to legitimate users.
• Depending on PHP classes available in the application (known as a POP chain), the object injection is capable of achieving full remote code execution on the underlying host.