LiveActive security incident?Get immediate response
CVE Record

CVE-2026-0726: Nexter Extension – Site Enhancements Toolkit <= 4.4.6 - Unauthenticated PHP Object Injection via 'nxt_unserialize_replace'

The Nexter Extension – Site Enhancements Toolkit plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.6 via deserialization of untrusted input in the 'nxt_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

HighCVSS 8.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2026-0726 affects the Nexter Extension WordPress plugin through version 4.4.6. An unauthenticated attacker may inject a PHP object, but the reported impact depends on another installed plugin or theme providing a usable POP chain. Without that, the source states there is no impact. No active exploitation is reported in the provided sources.

Executive priority

Treat this as a high-priority WordPress plugin update, especially for public sites. The risk is not automatically exploitable in every environment, but compromise impact could be severe when paired with another vulnerable plugin or theme.

Technical view

The issue is CWE-502 PHP object injection in the nxt_unserialize_replace function, caused by deserialization of untrusted input. CVSS is 8.1 High with network attack vector, no privileges, no user interaction, and high attack complexity. Potential outcomes include file deletion, sensitive data retrieval, or code execution if a suitable POP chain exists elsewhere on the site.

Likely exposure

WordPress sites running Nexter Extension – Security, Performance, Code Snippets & Site Toolkit version 4.4.6 or earlier are potentially exposed. Practical risk is higher on sites with additional plugins or themes that contain a compatible POP chain.

Exploitation context

The vulnerability is remotely reachable and unauthenticated, but exploitation is conditional. The source states the vulnerable plugin has no known POP chain itself. The CVE is not listed as KEV in the provided data, and no cited source confirms active exploitation.

Researcher notes

The record’s narrative clearly states versions up to 4.4.6 are affected, while the structured affected entry appears sparse. The WordPress changeset from 4.4.6 to 4.4.7 is relevant remediation evidence. No source in the bundle confirms exploitation in the wild.

Mitigation direction

  • Update Nexter Extension beyond 4.4.6; the referenced WordPress changeset compares 4.4.6 to 4.4.7.
  • Check the vendor or WordPress plugin page for the current fixed release guidance.
  • Reduce unnecessary plugins and themes to limit possible POP-chain exposure.
  • Prioritize internet-facing and business-critical WordPress sites.

Validation and detection

  • Inventory WordPress sites using the Nexter Extension plugin.
  • Confirm whether installed versions are 4.4.6 or earlier.
  • Verify the plugin was updated to a release after 4.4.6.
  • Review installed plugins and themes for unnecessary components.
  • Monitor web logs for suspicious requests targeting plugin functionality.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-502: Code execution behavior lookup

Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-0726 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.1CVSS 3.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

8.1High
CVSS 3.1 vector shape for CVE-2026-0726Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
posimyththemesNexter Extension – Security, Performance, Code Snippets & Site Toolkit0unaffected
Weakness

CWE details

CWE-502

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-502 · source CWE mapping

Deserialization of Untrusted Data

Deserialization of Untrusted Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs