CVE-2026-107436

{
  "etk_id": "ETK-2026-1974",
  "cve_id": "CVE-2026-107436",
  "display_id": "CVE-2026-107436",
  "ghsa_id": "GHSA-46gq-h347-cfrq",
  "euvd_id": "EUVD-2026-103433",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Object injection in Strong Testimonials",
  "summary": "Strong Testimonials versions through 3.3.12 are affected by unsafe deserialization. An attacker with the required access can inject objects, potentially affecting the confidentiality, integrity, and availability of the WordPress site.",
  "mitigation": "Deactivate and remove Strong Testimonials where it is not essential, or restrict access to trusted administrators while monitoring for an upstream update. No fixed version is recorded in the advisory.",
  "vendor": "wp chill",
  "product": "Strong Testimonials",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.3.12"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "strong-testimonials",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0036,
  "epss_percentile": 0.2775,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.43528903333333335,
  "t0_at": "2026-10-18T11:00:30.528000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-19T23:57:38.921501+00:00",
      "days": 1.539680480335648,
      "is_lower_bound": false,
      "measured_at": "2026-10-18T11:00:30.528000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-18T11:00:30.528000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-18T11:00:30.528000+00:00",
      "url": "https://github.com/advisories/GHSA-46gq-h347-cfrq"
    }
  }
}