CVE-2026-97188 String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor
Unauthenticated attackers can inject PHP objects via the database editor, potentially leading to remote code execution or data disclosure if a POP chain exists.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-97188?
CVE-2026-97188 is a high-severity unsafe deserialization vulnerability in Unknown String locator, published on 7 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present via another installed String locator WordPress plugin before 2.6.8 or , this can lead to arbitrary file deletion, sensitive data disclosure or remote code execution.
Weakness: CWE-502
Which versions are affected by CVE-2026-97188?
How do I fix CVE-2026-97188?
No fix has been published for CVE-2026-97188 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-97188 being exploited?
There is no known exploitation of CVE-2026-97188 in the wild and no public exploit code.
Sources
Also known as GHSA-jqxj-2pqp-v238.