CVE-2026-10035
Received Received - Intake

PHP Object Injection in Turnkey bbPress by WeaverTheme

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: Wordfence

Description
The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbp_set_to_serialized_values() function (reached through the wvrbbp_save_restore() settings-restore handler). The function reads the raw contents of an administrator-uploaded file and passes them directly to unserialize() without any validation. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin itself; however, if a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-10035
EUVD
EUVD-2026-59899

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
weavertheme bbpress to 1.7.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Turnkey bbPress by WeaverTheme WordPress plugin up to version 1.7.1 has a PHP Object Injection vulnerability. The issue occurs in the wvrbbp_set_to_serialized_values() function, which is triggered by the wvrbbp_save_restore() settings-restore handler. The function reads an administrator-uploaded file and passes its raw contents directly to unserialize() without validation. This allows authenticated attackers with administrator access to inject a PHP object.

Detection Guidance

To detect this vulnerability, check if the Turnkey bbPress by WeaverTheme plugin version 1.7.1 or lower is installed. Review server logs for administrator-uploaded files processed by the wvrbbp_set_to_serialized_values() function. Look for unserialize() calls on untrusted input.

Impact Analysis

Authenticated attackers with administrator-level access can exploit this vulnerability to inject a PHP object. If a POP chain exists in another installed plugin or theme, it could lead to arbitrary file deletion, sensitive data retrieval, or code execution on the affected system.

Mitigation Strategies

Immediately update the Turnkey bbPress by WeaverTheme plugin to the latest version. Remove administrator-level access for untrusted users. Disable the settings-restore handler wvrbbp_save_restore() if possible. Monitor for unusual file uploads or unserialize() usage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10035. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart