Zero Radar
← feed
CriticalVulnerabilityCVE-2026-114196updated 25 Oct 2026, 17:20 UTC

Paytium (WordPress plugin) can be tricked into running attacker-supplied data

A flaw in the Paytium plugin for WordPress lets an attacker send specially crafted data that the website then processes unsafely. This can let an outsider take control of or damage the website.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

What happened

Paytium (by paytiumsupport) has an unsafe deserialization flaw, classed as PHP Object Injection, where untrusted input is converted back into objects without validation.

Why it is dangerous: An attacker who exploits this could potentially run code, read or change data, or take over the website. Anyone whose site runs the affected plugin is at risk.

Are you affected?

You are affected if your WordPress site runs the Paytium plugin version 5.0.5 or earlier.

Paytium plugin (paytiumsupport): all versions through 5.0.5

What to do

  1. Check whether the Paytium plugin is installed and note its version
  2. Update Paytium to a version later than 5.0.5 as soon as a fixed release is available
  3. If no fix is available yet, deactivate Paytium until an update is released
  4. Watch the plugin vendor and the GitHub advisory GHSA-h3v7-j844-x6h5 for the patched version

Timeline

  1. 24 Oct 2026, 08:16 UTC
    Publicly disclosed
  2. 24 Oct 2026, 08:16 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 17:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-114196 · GHSA-h3v7-j844-x6h5
CVSS
9.8 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
24 Oct 2026, 08:16 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Paytium (WordPress plugin) can be tricked into running attacker-supplied data · Zero Radar