CVE-2026-54857

CriticalCVSS 9.8

Published: 29/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.49%

42th percentile - higher than 42% of all known CVEs

Summary

The Quirky plugin in versions up to and including 1.23 contains an unauthenticated PHP Object Injection vulnerability.

Risk Assessment

An unauthenticated attacker could supply crafted data leading to PHP object injection, potentially resulting in code execution or compromise of the WordPress application.

Recommendation

Update the Quirky plugin to a version later than 1.23 or disable it if no update is available.

Other vulnerabilities in Quirky

CVE-2025-69148High
There is an unauthenticated local file inclusion vulnerability in Quirky versions <= 1.23.

Original NVD description (English source)

Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS