Filter Everything — WordPress & WooCommerce Filters <= 1.9.7 - Authenticated (Contributor+) PHP Object Injection via Filter Set and Filter Post Content
- ID
- WPSEC-2026-2225
- Plugin
- Filter Everything — WordPress & WooCommerce Filters (filter-everything)
- Affected
- all versions before 1.9.8
- Remediation
- Update to 1.9.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-502
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Filter Everything — WordPress & WooCommerce Filters on WPSec AttackSurface
- Fix released
- Published
Description
The Filter Everything plugin for WordPress is vulnerable to PHP Object Injection via the Filter Set and Filter post content and meta in all versions up to, and including, 1.9.7. This is due to the plugin passing stored Filter Set and Filter data to maybe_unserialize(), while both post types were registered with the default 'post' capability type, which lets any user with the edit_posts capability create these posts and set their content, for example through XML-RPC. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP object that is deserialized when the plugin reads the post, for example when an administrator views the Filter Sets screen. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
References
- https://wpsec.com/vuln/WPSEC-2026-2225/
- https://plugins.svn.wordpress.org/filter-everything/tags/1.9.8/
- https://wordpress.org/plugins/filter-everything/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS