CVE-2026-59521 describes a deserialization of untrusted data vulnerability in the Real Testimonials plugin by ShapedPlugin LLC. This vulnerability allows an attacker with high privileges to perform object injection attacks by exploiting unsafe deserialization processes. The affected versions include all versions up to and including 3.1.15. The CVSS 3.1 base score is 7.2, indicating a high severity with network attack vector, low attack complexity, required high privileges, no user interaction, and impacts on confidentiality, integrity, and availability. No official remediation or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation can lead to full compromise of confidentiality, integrity, and availability of the affected system due to object injection via deserialization of untrusted data. The attacker must have high privileges to exploit this vulnerability. The vulnerability is exploitable remotely over the network without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and limit privileges to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.