WP Strong Testimonials Object Injection Flaw in Versions Through 3.3.12

The WP Chill Strong Testimonials plugin for WordPress contains a security flaw that permits object injection through the deserialization of untrusted data. The National Vulnerability Database assigned CVE-2026-107436 to this issue, rating it with a CVSS score of 8.8, which falls into the high severity category. This vulnerability exists in all versions of the plugin leading up to and including version 3.3.12.

Root cause

The underlying weakness is identified as CWE-502, deserialization of untrusted data. The National Vulnerability Database description states that this vulnerability allows object injection. The source material does not provide further technical details regarding the specific code path or validation failures that lead to this condition. It simply identifies the presence of the deserialization flaw within the plugin's architecture.

Attack path

An attacker can exploit this vulnerability by leveraging the deserialization of untrusted data. The NVD record explicitly links this weakness to object injection. The source material does not specify the exact request vector, such as HTTP method or endpoint, nor does it state whether prior authentication is required. It only confirms that the issue allows object injection via the described mechanism.

Affected versions

• WP Chill Strong Testimonials version 3.3.12
• All versions prior to 3.3.12
• No version is listed as unaffected below the current range

Mitigation

• Audit installed WordPress plugins to confirm if Strong Testimonials is present.
• Check the current version of the plugin against the affected range.
• Monitor for vendor announcements regarding a patched release.
• Restrict access to administrative interfaces where possible to limit exposure.

Signals worth monitoring

Teams usually watch for unexpected object creation or serialization errors in application logs. Check whether web server access logs show requests with unusually large or encoded POST bodies directed at plugin endpoints. Defenders often monitor for anomalous PHP process spawning or memory usage spikes that do not correlate with legitimate traffic. First containment moves typically involve disabling the vulnerable plugin if immediate patching is not available and isolating affected servers from internal network segments to prevent lateral movement.

What to do and how to stay safe: WP Chill

• Verify if your WordPress environment uses the Strong Testimonials plugin.
• Confirm the installed version is not 3.3.12 or earlier.
• Wait for the vendor to release a confirmed fix before assuming safety.
• Monitor server logs for signs of unauthorized object manipulation or injection attempts.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this vulnerability allow remote code execution?

The source material states the issue allows object injection via deserialization of untrusted data, but it does not explicitly confirm that remote code execution is possible.

Is authentication required to exploit this flaw?

The National Vulnerability Database record does not specify whether prior authentication is required to exploit CVE-2026-107436.

Which versions of the plugin are affected?

The vulnerability affects WP Chill Strong Testimonials versions from n/a through 3.3.12.