CVE-2026-116389 is a deserialization of untrusted data vulnerability in the crossi72 Phoenix Media Rename plugin, affecting versions up to 3.13.5. This flaw allows object injection, which can lead to high impact on confidentiality, integrity, and availability. The vulnerability has a high severity score of 8.8 and requires low privileges to exploit without user interaction.