# Filter Everything — WordPress & WooCommerce Filters <= 1.9.7 - Authenticated (Contributor+) PHP Object Injection via Filter Set and Filter Post Content

- **ID:** WPSEC-2026-2225
- **Plugin:** Filter Everything — WordPress & WooCommerce Filters (`filter-everything`), https://wordpress.org/plugins/filter-everything/
- **Affected versions:** all versions before 1.9.8
- **Fixed in:** 1.9.8 (Update to 1.9.8 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-502
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/filter-everything
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2225/

## Description

The Filter Everything plugin for WordPress is vulnerable to PHP Object Injection via the Filter Set and Filter post content and meta in all versions up to, and including, 1.9.7. This is due to the plugin passing stored Filter Set and Filter data to maybe_unserialize(), while both post types were registered with the default 'post' capability type, which lets any user with the edit_posts capability create these posts and set their content, for example through XML-RPC. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP object that is deserialized when the plugin reads the post, for example when an administrator views the Filter Sets screen. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

## References

- https://wpsec.com/vuln/WPSEC-2026-2225/
- https://plugins.svn.wordpress.org/filter-everything/tags/1.9.8/
- https://wordpress.org/plugins/filter-everything/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2225/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.