DLL Hijacking Vulnerability in PFI Plugin Framework by WordPress

CVE-2026-110022

What is CVE-2026-110022?

The PFI Plugin Framework allows for execution of DLLs from signed plugin packages. However, its deployment process inadequately verifies the integrity of some archive entries. This oversight enables an unauthenticated local attacker to substitute an unsigned DLL, which can bypass the signature verification. The malicious DLL could overwrite the legitimate signed assembly, leading to execution of attacker-controlled code within the affected systems, thereby significantly compromising system integrity.

References