CVE detail
CVE-2026-10035
The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbp_set_to_serialized_values() function (reached through the wvrbbp_save_restore() settings-restore handler). The function reads the raw contents of an administrator-uploaded file and passes them directly to unserialize() without any validation. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin itself; however, if a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 17.9 · diversity 6.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 5
- within the 30d window
- Peak daily
- 5
- highest bucket
Evidence
Source links by recency
5 source links · newest first
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7e7411ab-174e-4bc2-9f96-dbce925a21eb?source=cvewww.wordfence.com
No excerpt available.
Patchwww.wordfence.comAug 16, 2026, 6:16 AM - https://plugins.trac.wordpress.org/changeset?reponame=&old=3633471%40weaver-for-bbpress&new=3633471%40weaver-for-bbpressplugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgAug 16, 2026, 6:16 AM - https://plugins.trac.wordpress.org/browser/weaver-for-bbpress/tags/1.7.1/includes/wvrbbp-admin-top.php#L142plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgAug 16, 2026, 6:16 AM - https://plugins.trac.wordpress.org/browser/weaver-for-bbpress/tags/1.7.1/includes/wvrbbp-admin-lib.php#L132plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgAug 16, 2026, 6:16 AM - https://plugins.trac.wordpress.org/browser/weaver-for-bbpress/tags/1.7.1/includes/wvrbbp-admin-lib.php#L112plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgAug 16, 2026, 6:16 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-74012CVSS 8.8 · High
Editor PHP Object Injection in TaxoPress <= 3.51.0 versions.
- CVE-2026-73397CVSS 9.8 · Critical
Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.
- CVE-2026-73380CVSS 9.8 · Critical
Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
- CVE-2026-73376CVSS 9.8 · Critical
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.
- CVE-2026-73366CVSS 9.8 · Critical
Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.
- CVE-2026-73341CVSS 9.8 · Critical
Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.