CVE-2026-97283: Deserialization of Untrusted Data in Liquid Web / StellarWP Advanced Post Manager

This vulnerability involves deserialization of untrusted data in the Advanced Post Manager plugin by Liquid Web / StellarWP, enabling object injection attacks. The flaw affects all versions prior to 4.5.6, allowing an attacker to execute arbitrary code or manipulate application state by injecting malicious serialized objects. The CVSS 3.1 score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability.

Successful exploitation can lead to complete system compromise, including unauthorized code execution and data manipulation. The vulnerability impacts confidentiality, integrity, and availability at a high level, posing a critical risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates and consider disabling or restricting use of the affected plugin until a fix is available.