CVE-2026-97188: CWE-502 Deserialization of Untrusted Data in String locator

CVE-2026-97188 is a deserialization of untrusted data vulnerability (CWE-502) in the String locator WordPress plugin versions prior to 2.6.8. The plugin does not restrict which classes can be deserialized from database content saved through its database editor. This flaw allows unauthenticated attackers to inject serialized PHP objects into the database. When an administrator accesses and saves the compromised database row, the malicious object is instantiated. If a gadget chain (POP chain) is present in the same or another installed vulnerable version of the plugin, this can lead to severe impacts including arbitrary file deletion, disclosure of sensitive information, or remote code execution.

Successful exploitation requires an unauthenticated attacker to inject serialized objects into the database and an administrator to open and save the affected database row. The impact can be severe, including arbitrary file deletion, sensitive data disclosure, and remote code execution, depending on the presence of a suitable POP chain in the environment.

A fix is available in String locator version 2.6.8. Users should upgrade to version 2.6.8 or later to remediate this vulnerability. Until patched, restrict access to the database editor and avoid opening or saving database rows edited by untrusted users.