Deserialization Vulnerability in String Locator Plugin for WordPress
CVE-2026-97188

Currently unrated

Key Information:

Vendor

WordPress
Status
String Locator
Vendor
CVE Published:
7 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-97188?

The String Locator plugin for WordPress prior to version 2.6.8 is vulnerable due to insufficient restrictions on classes allowed during deserialization of database content. This flaw enables unauthenticated attackers to store serialized PHP objects within database rows through the plugin's database editor. Should an administrator later open and save these rows, and if an appropriate chain of events exists via another vulnerable installation of the String Locator plugin, the impact could range from arbitrary file deletion to exposure of sensitive data or even remote code execution.

Affected Version(s)

String locator 0 < 2.6.8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-97188 - Proof of Concept

References

https://wpscan.com/vulnerability/cfb495ac-32fc-43e2-81b4-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Raphael P. Cigana
WPScan
.