CVE-2026-97283 PUBLISHED

WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability

Assigner: Patchstack
Reserved: 24.09.2026 Published: 05.10.2026 Updated: 05.10.2026

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Liquid Web / StellarWP
Product	Advanced Post Manager
Versions	Default: unaffected affected from 0 to 4.5.5 (incl.)

Solutions

Update the WordPress Advanced Post Manager plugin to the latest available version (at least 4.5.6).

Credits

Peter Tang | Patchstack Bug Bounty Program finder

References

https://patchstack.com/database/wordpress/plugin/advanced-post-manager/vulnerability/wordpress-advanced-post-manager-plugin-4-5-5-php-object-injection-vulnerability?_s_id=cve

Problem Types

Deserialization of Untrusted Data CWE

Impacts

Object Injection