Unauthenticated PHP Object Injection in WPBruiser Plugin by WordPress
CVE-2026-65556

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
WPbruiser {no- Captcha Anti-spam}
Vendor
CVE Published:
6 August 2026

What is CVE-2026-65556?

The WPBruiser plugin, a widely used no-Captcha anti-spam tool in WordPress, is susceptible to an unauthenticated PHP Object Injection. This vulnerability affects versions 3.1.43 and earlier, allowing attackers to exploit it remotely without authentication. Malicious actors could potentially manipulate serialized objects to execute arbitrary PHP code, leading to unauthorized access and compromise of the site’s integrity.

Affected Version(s)

WPBruiser {no- Captcha anti-Spam} <= 3.1.43

References

https://patchstack.com/database/wordpress/plugin/goodbye-...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program
.