CVE-2026-91939: Cotonti

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.

Affected products

• Cotonti Cotonti: from 1.0.0, up to and including 1.0.0

Published 2026-09-15. Last modified 2026-09-16.