CVE-2026-94076
Received Received - Intake

Contributor PHP Object Injection in Squirrly SEO Plugin

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Patchstack

Description
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-94076
EUVD
EUVD-2026-89831

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
squirrly_seo seo_plugin to 14.2.5 (inc)
squirrly_seo wordpress_seo_plugin to 14.2.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-94076 is a PHP Object Injection vulnerability in the WordPress SEO Plugin by Squirrly SEO affecting versions 14.2.5 and earlier. Attackers with contributor or developer privileges can exploit this to manipulate data processing and execute harmful actions on the server.

Detection Guidance

Check if the Squirrly SEO plugin version is 14.2.5 or earlier. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files in /wp-content/plugins/squirrly-seo/. Monitor server logs for unusual PHP object injection patterns.

Impact Analysis

This vulnerability allows attackers to execute malicious actions on your server, potentially leading to unauthorized access, data theft, or complete system compromise. It could be exploited in mass campaigns targeting thousands of websites.

Mitigation Strategies

Update the Squirrly SEO plugin to version 14.2.6 or later immediately. Apply Patchstack's mitigation rule to block attacks until the update is complete. Restrict contributor or developer level access to the site.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94076. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart