Summary
A PHP Object Injection vulnerability exists in the Strong Testimonials plugin. This affects Strong Testimonials versions 3.3.12 and earlier. The vulnerability is patched in version 3.3.13 and later releases. There is no evidence of active exploitation for this vulnerability.
Affected and patched versions
Strong Testimonials (plugin strong-testimonials): affected 3.3.12 and earlier; fixed in 3.3.13
Is my site vulnerable?
To determine if your WordPress site uses a vulnerable version of the Strong Testimonials plugin, access your WordPress administration dashboard. Navigate to the 'Plugins' section and select 'Installed Plugins'. Locate 'Strong Testimonials' in the list of installed plugins. The version number is displayed next to the plugin name. If the displayed version is 3.3.12 or earlier, your site uses a vulnerable version. Versions 3.3.13 and later address this vulnerability.
What an attacker actually does
An attacker needs to have an authenticated account on the WordPress site, with at least subscriber-level permissions. With this level of access, the attacker can provide specially crafted input to the Strong Testimonials plugin. This input is then processed by the plugin in a way that involves deserialization. Deserialization is the process of taking a serialized string, which is a text representation of a data structure like an object, and converting it back into a live PHP object within the application's memory.
The vulnerability arises because the plugin deserializes this input without sufficient validation, meaning it trusts data that originates from an attacker. This allows the attacker to inject a malicious PHP object into the application's runtime environment. This injected object can then influence how the application behaves.
It is important to understand that the Strong Testimonials plugin itself does not contain a known "Property Oriented Programming" (POP) chain. A POP chain is a sequence of existing code within an application that can be triggered by manipulating the properties of an object during deserialization, leading to unintended and often malicious actions. However, the risk is not eliminated. If other plugins or themes installed on the same WordPress site do contain such POP chains, the injected PHP object from Strong Testimonials could then be used to activate these chains. This interaction between the vulnerable Strong Testimonials plugin and a POP chain in another component could lead to severe consequences. These potential consequences include the ability for an attacker to delete arbitrary files on the server, retrieve sensitive data stored within the WordPress installation or its database, or even execute arbitrary code on the server. The actual impact of such an attack is contingent upon the specific combination of software installed on the target WordPress environment.
How to detect a compromise
Detecting a compromise related to PHP Object Injection can be challenging without specific indicators, as the initial injection might not leave obvious traces in typical web server access logs or WordPress activity logs. The core vulnerability involves manipulating internal application objects, which may not directly manifest as external file changes or database entries in the immediate aftermath. However, if an attacker successfully exploited this vulnerability in conjunction with a Property Oriented Programming (POP) chain from another plugin or theme, there could be subsequent indicators of compromise that are more visible.
Begin by reviewing your server's access logs (e.g., Apache access logs, Nginx access logs) and PHP error logs for any unusual activity. Look for requests originating from authenticated user accounts, particularly those with subscriber-level access or higher, that involve POST requests to plugin-related endpoints around the time the vulnerability was publicly disclosed or after. While the specific payload might be obfuscated, unexpected request patterns or error messages could be indicative. If WordPress debug logging was enabled, review those logs for any deserialization errors or unexpected object instantiations.
Examine your WordPress database for unusual serialized data. Attackers might inject malicious objects that get stored in options tables (wp_options), post meta tables (wp_postmeta), or other plugin-specific tables. Look for entries that contain unexpected class names, unusually long serialized strings, or data that does not align with the expected format for legitimate plugin operations. While a direct grep command for the object injection itself might be difficult without knowing the specific payload, you can search for recently modified files on your server.
If an attacker successfully leveraged a POP chain to achieve file manipulation or code execution, look for unexpected changes to files on your server. This includes new files in unusual directories, modifications to existing core WordPress files, plugin files, or theme files, or the deletion of legitimate files. You can use command-line tools to identify recently modified files. For example, to list PHP files modified within the last 7 days in your WordPress installation directory: find /path/to/your/wordpress/root -name "*.php" -mtime -7 -print Adjust the /path/to/your/wordpress/root to your actual WordPress installation path and the -mtime value to suit your investigation timeframe.
Additionally, monitor your site's outgoing network connections for any unusual activity, which could indicate an attacker establishing a backdoor or exfiltrating data to an external server. Regularly review user accounts within your WordPress dashboard for any unauthorized additions, privilege escalations, or changes to existing user roles. Comparing current file states and database entries against known good backups can also help identify unauthorized modifications.
How to fix
To address the CVE-2026-107436 vulnerability, take the following steps:
Update the Strong Testimonials plugin: The primary fix is to update the Strong Testimonials plugin to version 3.3.13 or a later supported release. This version includes the necessary security patches. Access your WordPress administration dashboard, navigate to 'Plugins', then 'Installed Plugins'. Locate Strong Testimonials and click 'Update Now' if an update is available. If no update option appears, manually update the plugin.
Review other plugins and themes: While the Strong Testimonials plugin itself does not contain a known POP chain, other plugins or themes on your site might. Ensure all other installed software is also kept up to date to minimize the risk of a combined attack.
Implement secure coding practices (for developers): For developers, a general mitigation against PHP Object Injection vulnerabilities involves avoiding the deserialization of attacker-controlled input into application objects. Instead, use validated data-only formats for input where possible.
Timeline
Date | Event |
|---|---|
2026-10-08 | Fix released |
2026-10-16 | Wordfence report |
2026-10-18 | CVE published |
2026-10-19 | Fix released |