CVE-2026-10035 describes a PHP Object Injection vulnerability in the Turnkey bbPress by WeaverTheme WordPress plugin, affecting all versions up to 1.7.1. The vulnerability arises from the wvrbbp_set_to_serialized_values() function, which unserializes raw contents of an administrator-uploaded file without validation. This occurs through the wvrbbp_save_restore() settings-restore handler. An attacker with administrator privileges can inject a PHP object. Although the vulnerable plugin lacks a native POP chain, exploitation can occur if other installed plugins or themes provide one, potentially enabling arbitrary file deletion, sensitive data retrieval, or code execution.

An attacker with administrator-level privileges can exploit this vulnerability to inject PHP objects via deserialization. If a suitable POP chain exists in other installed plugins or themes, this could lead to arbitrary file deletion, disclosure of sensitive information, or remote code execution. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and avoid uploading untrusted files through the affected functionality. Monitor vendor channels for updates or patches addressing this vulnerability.