PHP Object Injection in Reycob Product Import Export Plugin
CVE-2026-95603

7.2HIGH

Key Information:

Vendor

WordPress
Status
Reycob Product Import Export
Vendor
CVE Published:
23 September 2026

What is CVE-2026-95603?

The Reycob Product Import Export plugin for WordPress is affected by a PHP Object Injection vulnerability. This issue affects versions up to 2.3.0, allowing attackers to inject malicious PHP objects through crafted requests, potentially compromising the integrity of the site. It is crucial for site administrators using this plugin to evaluate their environments and update to secure versions to protect against exploitation.

Affected Version(s)

Reycob Product Import Export <= 2.3.0

References

https://patchstack.com/database/wordpress/plugin/reycob-p...
vdb-entry

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program
.