CVE-2026-100506

Received Received - Intake

WP Spell Check Object Injection Vulnerability

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: Patchstack

Description

Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-05

Generated

2026-10-06

AI Q&A

2026-10-06

EPSS Evaluated

N/A

NVD

CVE-2026-100506

EUVD

EUVD-2026-92752

Affected Vendors & Products

Vendor	Product	Version / Range
WP	Spell	Check WP Spell Check 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

CVE-2026-100506 is a PHP Object Injection vulnerability in the WordPress WP Spell Check Plugin affecting versions 12.1 and below. It allows attackers to inject malicious objects during deserialization, potentially leading to unauthorized actions on the server.

Detection Guidance

To detect this vulnerability, check if your WordPress site is running WP Spell Check plugin version 12.1 or below. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin version in the WordPress admin panel. If vulnerable, update to version 12.2 immediately.

Impact Analysis

This vulnerability can allow attackers to execute harmful actions on your website, such as taking control of the site, stealing data, or disrupting services. It has a CVSS score of 7.2, indicating a moderate to high risk of exploitation.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations must address it to maintain data protection standards.

Mitigation Strategies

Update the WP Spell Check plugin to version 12.2 or later immediately. If updating is not possible, apply the mitigation rule provided by Patchstack to block attacks until the update is applied.

Hi! I’m here to help you understand CVE-2026-100506. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70