External risk intelligence

Advanced Post Manager Object Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-97283

This is a vulnerability in a WordPress plugin. WordPress plugins are commonly used to extend public-facing web applications, making the attack surface frequently reachable via the internet as part of a standard website deployment.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Advanced Post Manager software, a component used by Liquid Web and StellarWP. This issue involves the handling of untrusted data, potentially allowing attackers to inject malicious code. While the exact business impact is still under review, such vulnerabilities can pose significant risks to data integrity and system availability.

Data can be improperly handled.
Confirms the need for product relevance checks.
Prioritize confirming exposure to this plugin.

Attack Path

How an attacker could exploit the issue

An attacker could potentially reach this vulnerability by exploiting the Advanced Post Manager plugin through network access without requiring any specific user interaction or privileges. This exposure allows for object injection, enabling an attacker to inject malicious code and take control of the affected website.

Entry condition: Publicly accessible through the network.
Trigger point: Via the Advanced Post Manager plugin.
Resulting risk: Full website compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious objects into the application when processing untrusted data, potentially leading to unauthorized actions. This could affect the integrity and availability of the WordPress site.

Sensitive system data.
Untrusted data processing.
Unauthorized actions and site disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The critical deserialization vulnerability in Advanced Post Manager requires immediate attention from application owners and the platform team. The first practical step is to identify all instances of this plugin, confirm their network exposure and business criticality, and then assign an owner for remediation planning.

Application owners should prioritize this.
Verify plugin instances and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Advanced Post Manager?

Advanced Post Manager is a plugin for WordPress, the content management system used to build and maintain websites. It functions as an add-on that helps site administrators organize, filter, and manage their content more effectively. By extending the core capabilities of WordPress, it allows users to customize how posts appear and behave on their digital platforms.

How does CVE-2026-97283 allow object injection?

This vulnerability is classified as Deserialization of Untrusted Data (CWE-502). It occurs when the plugin takes data from an untrusted source and reconstructs it into a programming object without proper verification. By manipulating this incoming data, an attacker can inject malicious objects, which tricks the application into executing unintended code or performing actions the developer never authorized.

Do I need to be logged in for this attack to work?

No. The vulnerability does not require the attacker to have an account, special privileges, or any user interaction to trigger it. The flaw resides in how the plugin processes network requests, meaning it can be exploited remotely by an unauthenticated party. Simply having the plugin active and reachable via the network is enough to potentially allow an unauthorized injection.

Is my website at risk from this plugin vulnerability?

Halo Surface Signal indicates that because this is a WordPress plugin, it is often part of a public-facing website deployment. If your installation of Advanced Post Manager is accessible over the internet, your site is reachable by external actors. You should assume that any web-facing component using this software is exposed to the potential for unauthorized site control.

What should I do if I use Advanced Post Manager?

Your first step is to perform an inventory of all your websites to locate every instance where this plugin is currently installed. Once identified, evaluate whether the site is exposed to the internet and determine its business importance. Assign a clear owner to manage the plugin's status, verify your exposure levels, and prepare a plan to remove or update the software as needed.

References

patchstack.com/database/wordpress/plugin/advanced-post-manager/vulne…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.