CVE-2026-97188: String locator 0 to before 2.6.8

Affected technology

String locator · 0 to before 2.6.8
Vendor not specified by the source

Description’s affected range: before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

The source says the String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. Source advisory’s CVSS 3.1 assessment (base score 8.8/10) rates confidentiality, integrity and availability impact as high.