PT-2026-23813 · WordPress · Wordpress+1

Athiwat Tiprasaharn + 2 · Published 2026-03-07 · Updated 2026-03-12 · CVE-2026-2020

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress JS Archive List plugin versions up to and including 6.1.7

Description The JS Archive List plugin for WordPress is susceptible to PHP Object Injection through the 'included' shortcode attribute. This occurs because of the deserialization of untrusted input provided through the 'included' parameter of the plugin’s shortcode. Authenticated attackers with Contributor-level access or higher can inject a PHP Object. Currently, no known practical exploitation chain (POP chain) exists within the vulnerable software itself. However, if a POP chain is present through an additional plugin or theme installed on the target system, an attacker could potentially delete arbitrary files, retrieve sensitive data, or execute code.

Recommendations Update the JS Archive List plugin to a version newer than 6.1.7.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-2020

Affected Products

Js Archive List

Wordpress

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2026-2020 · Security Note
• https://twitter.com/VulmonFeeds/status/2030145244835037338 · Twitter Post
• https://twitter.com/infoflowcloud/status/2030340430093525142 · Twitter Post
• https://twitter.com/CVEnew/status/2030339367047426094 · Twitter Post
• https://plugins.trac.wordpress.org/browser/jquery-archive-list-widget/tags/6.1.7/classes/class-jq-archive-list-widget.php#L674 · Note
• https://plugins.trac.wordpress.org/browser/jquery-archive-list-widget/tags/6.1.7/classes/class-js-archive-list-settings.php#L10 · Note
• https://plugins.trac.wordpress.org/browser/jquery-archive-list-widget/trunk/classes/class-js-archive-list-settings.php#L10 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3466978%40jquery-archive-list-widget&new=3466978%40jquery-archive-list-widget&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9b0f6653-471b-4cee-9c92-f24dbe2c2dbd?source=cve · Note
• https://t.me/cveNotify/154562 · Telegram Post
• https://twitter.com/cracbot/status/2032049002993369543 · Twitter Post
• https://plugins.trac.wordpress.org/browser/jquery-archive-list-widget/trunk/classes/class-jq-archive-list-widget.php#L674 · Note
• https://t.me/CVEtracker/46677 · Telegram Post