CVE-2026-118074

Name of the Vulnerable Software and Affected Versions Finale Lite versions prior to 2.21.1

Description The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress allows authenticated attackers with shop manager-level access and above to perform PHP Object Injection. This occurs due to the deserialization of untrusted input, which is the process of converting a stored string back into a PHP object. While no POP chain (a sequence of gadgets used to execute malicious code) is present in the software itself, the presence of one in another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update to a version newer than 2.21.0.