External risk intelligence

Document Library Pro Object Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-122662

The vulnerability affects a WordPress plugin, which is a component of a web application. WordPress sites are frequently internet-facing, and plugin functionality is often accessible to public users, making the attack surface likely to be exposed to the internet in common deployments.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE involves a critical vulnerability in the Document Library Pro plugin that could allow unauthorized code execution by attackers without needing to log in. While the specific impact depends on how the plugin is used, the potential for system compromise warrants attention. The main concern is confirming relevance and exposure to our environment.

Untrusted data can inject malicious code.
Critical flaw affects public-facing websites.
Assess if this plugin is in use.

Attack Path

How an attacker could exploit the issue

An attacker can leverage this vulnerability by sending specially crafted data to the vulnerable plugin over the network, as no specific user authentication is required. This data, when deserialized by the plugin, can lead to object injection, potentially allowing the attacker to execute arbitrary code or manipulate the application's behavior.

No authentication needed.
Triggered by deserializing untrusted data.
Allows code execution or manipulation.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to inject malicious objects into the system through the Document Library Pro plugin when it processes untrusted data. This could potentially lead to unauthorized access and modification of sensitive information or disruption of service.

System data and service behavior.
Untrusted data processed by the plugin.
Potential for unauthorized access or disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Document Library Pro plugin's deserialization vulnerability impacts WordPress sites, making application owners and platform teams responsible for its management. The first practical step is to identify all instances of the affected plugin, confirm their exposure and criticality, and then coordinate remediation with the vendor or apply necessary updates.

Application owners should own the issue.
Verify plugin reachability and business criticality.
Plan vendor coordination or update deployment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Document Library Pro?

Document Library Pro is a plugin for WordPress designed to help site administrators display, organize, and manage collections of documents. It acts as an extension to a website's core functionality, providing specific tools for users to search, filter, and download files directly from the site interface.

What does CWE-502 Object Injection mean for CVE-2026-122662?

CWE-502 refers to the deserialization of untrusted data. In this vulnerability, the plugin takes data provided by an external source and reconstructs it into a programming object without proper validation. Because the plugin blindly trusts this input, an attacker can supply a specially crafted object that forces the system to execute unauthorized code or perform unintended actions.

How is this vulnerability triggered?

The flaw is triggered when the plugin processes malicious, crafted data sent over a network. It does not require any prior authentication or special user privileges to initiate. Simply interacting with the plugin's data-processing functions is enough. Standard user actions that do not involve sending this type of serialized data to the plugin do not activate the vulnerability.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a likely risk because Document Library Pro is a WordPress component. Since WordPress sites are frequently designed to be internet-facing to serve public users, the plugin's functionality is often directly reachable from the web. This placement increases the likelihood that an attacker can reach the vulnerable code path.

How should I respond if I use this plugin?

Your first step is to inventory your WordPress environments to confirm if Document Library Pro is installed and determine if you are running a version prior to 4.2.2. Once identified, evaluate the plugin's accessibility to the internet. Coordinate with your team to prioritize applying the vendor's provided update, which resolves the deserialization flaw and secures the data-handling process.

References

patchstack.com/database/wordpress/plugin/document-library-pro/vulner…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.