CVE-2026-12115 describes a PHP Object Injection vulnerability in the Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin. The vulnerability arises from unsafe deserialization of untrusted data in all versions up to and including 2.0.13. An attacker with administrator privileges can inject a PHP object. However, no gadget chain is present in the plugin itself, so exploitation requires another plugin or theme with a suitable POP chain to achieve code execution or other impacts. The deserialization is triggered automatically during post-import redirect rendering and item editing, facilitating exploitation without additional user actions.

If exploited in an environment where a suitable POP chain exists in other installed plugins or themes, an attacker with administrator access could delete arbitrary files, retrieve sensitive data, or execute arbitrary code. Without such a chain, the vulnerability does not lead to impact. The vulnerability requires high privileges (administrator) and does not involve user interaction beyond the import action.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, administrators should monitor the vendor's communications for updates. Mitigation involves removing or updating the vulnerable plugin and ensuring that no other plugins or themes provide gadget chains that could be exploited. Restrict administrator access to trusted users only.