CVE-2026-97188

{
  "etk_id": "ETK-2026-1308",
  "cve_id": "CVE-2026-97188",
  "display_id": "CVE-2026-97188",
  "ghsa_id": "GHSA-jqxj-2pqp-v238",
  "euvd_id": "EUVD-2026-94190",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unsafe PHP object deserialization in String locator",
  "summary": "String locator versions before 2.6.8 allow unauthenticated users to save serialized object data through the database editor. When an administrator later opens and saves the affected database row, the object may be deserialized; a compatible gadget chain in installed plugins can enable file deletion, data exposure, or code execution.",
  "mitigation": "Update the String locator WordPress plugin to version 2.6.8 or later. Until updating, limit access to the database editor and review its stored rows for unexpected serialized content.",
  "vendor": null,
  "product": "String locator",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.6.8"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.6.8"
      ],
      "package_name": "String locator",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 8.8,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "epss_score": 0.0038,
  "epss_percentile": 0.3021,
  "epss_asof": "2026-10-21",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 32.849295033333334,
  "t0_at": "2026-10-07T06:00:08.821000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-12T05:20:04.376805+00:00",
      "days": 4.972170784780093,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T06:00:08.821000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-07T06:00:08.821000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T06:00:08.821000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97188"
    }
  }
}