CVE-2026-97188: Unknown String Locator

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present via another installed String locator WordPress plugin before 2.6.8 or , this can lead to arbitrary file deletion, sensitive data disclosure or remote code execution.

Affected products

• Unknown String Locator: before 2.6.8 (fixed in 2.6.8)

Published 2026-10-07. Last modified 2026-10-07.