CVE-2026-54859

CriticalCVSS 9.8

Published: 29/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.53%

45th percentile - higher than 45% of all known CVEs

Summary

The Preservation plugin in versions up to and including 1.15 contains an unauthenticated PHP Object Injection vulnerability.

Risk Assessment

An unauthenticated attacker could supply crafted data leading to PHP object injection, potentially resulting in code execution or compromise of the WordPress application.

Recommendation

Update the Preservation plugin to a version later than 1.15 or disable it if no update is available.

Other vulnerabilities in Preservation

CVE-2025-69144High
There is a vulnerability in Preservation <= 1.10 that allows unauthenticated local file inclusion.

Original NVD description (English source)

Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS