CVE-2026-22384
Published: 20 February 2026
Summary
CVE-2026-22384 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-22384 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the leafcolor Applay - Shortcodes WordPress plugin (applay-shortcodes), enabling Object Injection. The issue affects all versions of the plugin from n/a through 3.7 inclusive. Published on 2026-02-20, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows object injection via untrusted deserialization, which could lead to high impacts on confidentiality, integrity, and availability, such as arbitrary code execution or data manipulation depending on the deserialized objects.
The Patchstack advisory provides details on this WordPress plugin vulnerability at https://patchstack.com/database/Wordpress/Plugin/applay-shortcodes/vulnerability/wordpress-applay-shortcodes-plugin-3-7-php-object-injection-vulnerability?_s_id=cve, including recommended mitigations such as updating to a patched version if available or disabling the plugin.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8258
Vulnerability details
Deserialization of Untrusted Data vulnerability in leafcolor Applay - Shortcodes applay-shortcodes allows Object Injection.This issue affects Applay - Shortcodes: from n/a through <= 3.7.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated deserialization/RCE in public-facing WordPress plugin directly matches T1190 Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Remediating the deserialization of untrusted data flaw in the Applay - Shortcodes WordPress plugin through timely patching directly prevents object injection exploitation.
Validating shortcode inputs prior to deserialization comprehensively blocks untrusted data from enabling object injection in the vulnerable plugin.
Enforcing least functionality by disabling or restricting the unnecessary Applay - Shortcodes plugin eliminates the deserialization vulnerability exposure.