CVE-2026-91939

Received Received - Intake

Cotonti Comments Plugin PHP Object Injection Vulnerability

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-91939

Affected Vendors & Products

Vendor	Product	Version / Range
cotonti	comments_plugin	1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability in Cotonti 1.0.0's Comments plugin allows unauthenticated attackers to exploit PHP object injection by passing a crafted 'ci' GET parameter to unserialize() without proper class restrictions. Attackers can instantiate arbitrary PHP classes to trigger gadget chains, enabling database manipulation or code execution.

Detection Guidance

Check Cotonti Comments plugin endpoints for GET parameter 'ci' usage. Monitor for unusual serialized payloads in HTTP requests. Inspect PHP error logs for unserialize() warnings or object injection attempts.

Impact Analysis

An attacker could exploit this to execute arbitrary code on your server, manipulate database contents, or gain unauthorized access to sensitive data. Since it requires no authentication, the risk is high for any system running the vulnerable plugin.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Non-compliance risks include legal penalties and reputational damage.

Mitigation Strategies

Update Cotonti to the latest version. Disable the Comments plugin if unused. Apply input validation to block serialized payloads in 'ci' parameter. Restrict PHP unserialize() to allowed classes.

Hi! I’m here to help you understand CVE-2026-91939. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70