{"schema":"threatline.record/2","record":{"id":"CVE-2026-116389","aliases":[],"summary":"WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability","details":"Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object Injection.This issue affects Phoenix Media Rename: from n/a through 3.13.5.","categories":["Unclassified"],"product":"Phoenix Media Rename","vendor":"crossi72","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116389","source_modified_at":"2026-10-28T14:02:56.685Z","fetched_at":"2026-10-28T15:55:58.673066Z","product":"Phoenix Media Rename","vendor":"crossi72","versions":[{"version":"0","versionType":"custom","status":"affected","lessThanOrEqual":"3.13.5"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":8.8,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T14:02:56.685Z","modified_at":"2026-10-28T14:02:56.685Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116389","fetched_at":"2026-10-28T15:55:58.673066Z","source_modified_at":"2026-10-28T14:02:56.685Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://patchstack.com/database/wordpress/plugin/phoenix-media-rename/vulnerability/wordpress-phoenix-media-rename-plugin-3-13-5-php-object-injection-vulnerability?_s_id=cve","tags":["vdb-entry"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T14:02:56.685Z","content_hash":"3ccc524ae63c1bc8b1f65760c1425c03bf39874b6ac9c833a72ad6644f334df1"}}