The Super Stage WP WordPress plugin through 1.0.1 unserializes user input via REQUEST, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
CVE-2026-1542
NONE
EPSS 0.10%
Updated Feb 28, 2026
WordPress
CVE Details
CVE ID
CVE-2026-1542
Published Date
Feb 28, 2026
Vendor
WordPress
Severity
NONE
Exploit Prediction (EPSS)
Probability of Exploit
0.10%
Likelihood of exploitation in next 30 days
Percentile:
27.5th percentile (higher than 27.5% of all CVEs)
Standard patching cycle
Impact
Minimal impact
Source
View Advisory