MEDIUM

CVE-2026-27410

2026-06-17 CVSS v3.1

CVSS

6.5

Description

Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions.

Summary dbcve.org

This is an insecure deserialization vulnerability in the Slimstat Analytics WordPress plugin versions prior to 5.4.0. The plugin uses PHP's unserialize() function on untrusted data without proper validation, allowing unauthenticated attackers to craft malicious serialized PHP objects that could potentially achieve remote code execution through PHP object injection.

Mitigation

Update Slimstat Analytics to version 5.4.0 or later which contains the patch for this vulnerability. As this is a critical security update, apply it immediately after testing in a non-production environment.

Weakness (CWE)

CWE-502 Deserialization of Untrusted Data

EPSS Score

0.27%

Probability of exploitation in next 30 days

20.1th percentile

References

https://patchstack.com/database/wordpress/plugin/wp-slimstat/vulnerability/wordpress-slimstat-analytics-plugin-5-4-0-deserialization-of-untrusted-data-vulnerability?_s_id=cve

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE