{
 "id": "WPSEC-2026-2225",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2225/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2225/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2225/index.md",
 "title": "Filter Everything — WordPress & WooCommerce Filters <= 1.9.7 - Authenticated (Contributor+) PHP Object Injection via Filter Set and Filter Post Content",
 "description": "The Filter Everything plugin for WordPress is vulnerable to PHP Object Injection via the Filter Set and Filter post content and meta in all versions up to, and including, 1.9.7. This is due to the plugin passing stored Filter Set and Filter data to maybe_unserialize(), while both post types were registered with the default 'post' capability type, which lets any user with the edit_posts capability create these posts and set their content, for example through XML-RPC. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP object that is deserialized when the plugin reads the post, for example when an administrator views the Filter Sets screen. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
 "plugin": {
  "slug": "filter-everything",
  "name": "Filter Everything — WordPress & WooCommerce Filters",
  "full_name": "Filter Everything — WordPress & WooCommerce Filters",
  "wordpress_org": "https://wordpress.org/plugins/filter-everything/",
  "advisories_url": "https://wpsec.com/vuln/plugin/filter-everything/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/filter-everything"
 },
 "type": "OBJECT INJECTION",
 "cwe": [
  "CWE-502"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.5,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.9.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.9.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.9.8",
 "remediation": "Update to 1.9.8 or later.",
 "fix_released": "2026-11-02T11:00:27+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:20:28.743517+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2225/",
  "https://plugins.svn.wordpress.org/filter-everything/tags/1.9.8/",
  "https://wordpress.org/plugins/filter-everything/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/filter-everything",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}