CVE-2026-116867

Name of the Vulnerable Software and Affected Versions Dynamic QR Code – generator versions prior to 1.0.2

Description The plugin is susceptible to PHP Object Injection, a condition where an application deserializes untrusted input, potentially allowing an attacker to manipulate the application logic. Authenticated users with contributor-level access or higher can inject a PHP Object. While no native POP chain (a sequence of gadgets used to achieve code execution) exists within the software, the presence of a POP chain in other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update to a version newer than 1.0.1.