Authenticated attackers with subscriber-level access can inject a PHP Object into the Strong Testimonials plugin due to deserialization of untrusted input.
Affected component: Strong Testimonials (plugin)
Fixed in: 3.3.13
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since October 28, 2026. No PowerSEC firewall rule blocks this attack. Update to 3.3.13 or later to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-107436