CVE-2026-65572

Name of the Vulnerable Software and Affected Versions A.Williams versions prior to 1.3.2

Description The A.Williams plugin for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. This issue occurs when the application processes data without sufficient validation, allowing an attacker to inject a PHP Object. While no POP chain (a sequence of gadgets used to achieve code execution) is present within the plugin itself, the impact depends on other installed plugins or themes. If a POP chain is available via another component, an attacker could delete arbitrary files, retrieve sensitive data, or execute code.

Recommendations Update A.Williams to version 1.3.2 or later.