CVE-2026-7635 describes a PHP Object Injection vulnerability in the coreActivity: Activity Logging for WordPress plugin. The plugin fails to validate or sanitize the User-Agent HTTP header before storing it in the logmeta table. Later, the plugin calls maybe_unserialize() on the stored data without verifying its origin, allowing an attacker to inject malicious serialized data. When an administrator accesses the Logs page, the deserialization triggers a fatal TypeError in DeviceDetector::setUserAgent(), causing a persistent denial of service by preventing access to the Logs page.

This vulnerability allows unauthenticated attackers to cause a persistent denial of service condition by injecting malicious serialized data via the User-Agent header. The denial of service specifically affects administrators by blocking access to the Logs page, potentially hindering incident response and monitoring capabilities. The CVSS score of 8.1 indicates high severity with impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting access to the Logs page or filtering User-Agent headers at the web server or firewall level to block suspicious serialized payloads. Avoid viewing the Logs page if suspicious activity is suspected to prevent triggering the denial of service.