Executive brief
OptionTree is a popular WordPress plugin used to create customizable options and settings pages for themes and plugins. The vulnerability allows authenticated users with Editor privileges to inject malicious PHP objects through the plugin's editor functionality, potentially enabling remote code execution and full compromise of the WordPress site.
Technical details
OptionTree versions 2.7.3 and earlier contain a PHP Object Injection vulnerability in the editor component. The vulnerability exists due to improper handling of user-supplied data that gets unserialized without proper validation, allowing an attacker with Editor-level WordPress permissions to instantiate arbitrary PHP objects. An authenticated attacker with Editor role can craft malicious serialized data to trigger unsafe deserialization, potentially leading to remote code execution on the server. As of the publication date, no official patch from the vendor is available; Patchstack offers a mitigation rule to block exploitation attempts.
Affected products
- OptionTree OptionTree 2.7.3 and earlier
Timeline
- 2026-08-18: disclosed: Vulnerability published on NVD and Patchstack
- 2026-07-06: other: Reported by Ananda Dhakal (Patchstack)