Is CVE-2026-118081 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118081 being exploited in the wild.

How severe is CVE-2026-118081?

High severity, with a CVSS score of 8.8, published 29 October 2026.

Which products and versions are affected?

10Web Social Photo Feed <= 1.5.6.

How is CVE-2026-118081 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-118081?

Check whether you run 10Web Social Photo Feed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118081: 10Web Social Photo Feed PHP Object Injection

Q: Is there a fix for CVE-2026-118081?

No fixed version is recorded yet. If unable to update immediately, implement role-based access controls to restrict Contributor-level accounts and use a web application firewall or Patchstack's mitigation rules to block exploitation attempts until a patch is available. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-118081 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-118081?

Check whether you run 10Web Social Photo Feed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118081 · Severity: high · CVSS 8.8 · Published 2026-10-29

10Web Social Photo Feed is a WordPress plugin that displays photos from social media on a website. A PHP Object Injection vulnerability allows authenticated users with the Contributor role to execute arbitrary code on the web server. This could lead to complete compromise of the affected WordPress site and any data it contains.

Vendors: 10Web.

Quick answers

Is CVE-2026-118081 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118081 being exploited in the wild.
How severe is CVE-2026-118081?: High severity, with a CVSS score of 8.8, published 29 October 2026.
Which products and versions are affected?: 10Web Social Photo Feed <= 1.5.6.
Is there a fix for CVE-2026-118081?: No fixed version is recorded yet. If unable to update immediately, implement role-based access controls to restrict Contributor-level accounts and use a web application firewall or Patchstack's mitigation rules to block exploitation attempts until a patch is available. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-118081 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-118081?: Check whether you run 10Web Social Photo Feed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

If unable to update immediately, implement role-based access controls to restrict Contributor-level accounts and use a web application firewall or Patchstack's mitigation rules to block exploitation attempts until a patch is available.

Technical details

A PHP Object Injection vulnerability (CWE-502) in the plugin allows attackers with Contributor-level privileges to manipulate object serialization and trigger unserialize() operations with untrusted data. This permits remote code execution on the server. No official patch is currently available; affected versions are 1.5.6 and earlier.

Affected products

10Web Social Photo Feed <= 1.5.6

Timeline

2026-10-29: disclosed
2026-10-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.