CVE-2025-49386

Name of the Vulnerable Software and Affected Versions Preserve Code Formatting versions prior to 4.0.2

Description The software is subject to PHP Object Injection due to the deserialization of untrusted data. Authenticated attackers with contributor-level access or higher can inject a PHP Object. While no native POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) is present in the software, the presence of a POP chain in other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update to a version newer than 4.0.1.