CVE-2026-27410

Name of the Vulnerable Software and Affected Versions Slimstat Analytics versions prior to 5.4.0

Description Unauthenticated attackers can perform PHP Object Injection through the deserialization of untrusted data. This issue occurs when the software fails to properly validate input before passing it to a deserialization function. While no POP chain (a sequence of gadgets used to execute malicious code during deserialization) is present within the software itself, the impact depends on other installed plugins or themes. If a POP chain exists in another component, an attacker could delete arbitrary files, retrieve sensitive data, or execute code.

Recommendations Update Slimstat Analytics to version 5.4.0 or later.