Is CVE-2026-105885 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105885 being exploited in the wild.

How severe is CVE-2026-105885?

High severity, with a CVSS score of 8.8, published 10 October 2026.

Which products and versions are affected?

10Web Slider by 10Web through 1.2.62.

Is there a fix for CVE-2026-105885?

Yes: fixed in 1.2.63 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-105885 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-105885?

Check whether you run 10Web Slider by 10Web at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105885: 10Web Slider by 10Web PHP object injection

CVE-2026-105885 · Severity: high · CVSS 8.8 · Published 2026-10-10

The Slider by 10Web WordPress plugin allows unauthorized code execution through unsafe deserialization of untrusted data. An attacker with contributor-level access can inject malicious PHP objects to run arbitrary commands on the web server, potentially compromising the entire website and its data.

Vendors: 10Web.

Quick answers

Is CVE-2026-105885 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105885 being exploited in the wild.
How severe is CVE-2026-105885?: High severity, with a CVSS score of 8.8, published 10 October 2026.
Which products and versions are affected?: 10Web Slider by 10Web through 1.2.62.
Is there a fix for CVE-2026-105885?: Yes: fixed in 1.2.63 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105885 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-105885?: Check whether you run 10Web Slider by 10Web at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.2.63 or later

Technical details

A PHP object injection vulnerability in the Slider by 10Web plugin through version 1.2.62 allows attackers to manipulate serialized object data and instantiate arbitrary PHP objects on the server. The vulnerability requires contributor-level WordPress privileges to exploit. Successful exploitation enables remote code execution with the privileges of the web server process.

Affected products

10Web Slider by 10Web through 1.2.62

Timeline

2026-10-10: disclosed
2026-10-08: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.