Cyber Resilience

CVE-2026-22333

HighRCE

Published: 19 February 2026

Published
19 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0002 6.8th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22333 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).

Deeper analysis

CVE-2026-22333 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the YITH WooCommerce Compare plugin (yith-woocommerce-compare) from YITHEMES for WordPress. Published on 2026-02-19, it enables Object Injection and affects all versions from n/a through 3.6.0.

The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating a high-severity issue exploitable over the network with low attack complexity. It requires high privileges (PR:H), such as those held by authenticated administrators, and no user interaction. Attackers can achieve high impacts on confidentiality, integrity, and availability through object injection, potentially resulting in remote code execution or other severe compromises on affected WordPress sites.

The Patchstack advisory provides further details on this vulnerability, including assessment and mitigation guidance, at https://patchstack.com/database/Wordpress/Plugin/yith-woocommerce-compare/vulnerability/wordpress-yith-woocommerce-compare-plugin-3-6-0-deserialization-of-untrusted-data-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Deserialization of Untrusted Data vulnerability in YITHEMES YITH WooCommerce Compare yith-woocommerce-compare allows Object Injection.This issue affects YITH WooCommerce Compare: from n/a through <= 3.6.0.

CWE(s)
CWE-502

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Deserialization/object injection in a public-facing WordPress plugin directly enables remote exploitation of the web application, matching T1190 for initial access and RCE.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-13770Shared CWE-502
CVE-2026-27303Shared CWE-502
CVE-2025-53586Shared CWE-502
CVE-2025-64353Shared CWE-502
CVE-2025-31047Shared CWE-502
CVE-2026-27096Shared CWE-502
CVE-2023-49886Shared CWE-502
CVE-2026-23542Shared CWE-502
CVE-2025-66631Shared CWE-502
CVE-2026-40044Shared CWE-502

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation and sanitization of all input data before any deserialization operation, blocking the untrusted object injection vector in the plugin.

AC-6 Least Privilege partial match
prevent

Limits the high-privilege (administrator) accounts that can reach the vulnerable deserialization code path, reducing the attack surface.

SI-7 Software, Firmware, and Information Integrity partial match
preventdetect

Verifies integrity of serialized objects and plugin code before processing, detecting tampering that would enable object injection.

References