LeakyCreds
NewInstant webhook alerts now available ā€” notified within seconds of any credential detection.Learn more ā†’
Home / Vulnerability Intelligence / CVE-2026-25445

CVE-2026-25445 - Vulnerability Analysis

HighCVSS: 8.8

Last Updated: March 19, 2026

WishList Member X - Insecure Deserialization

Published: March 19, 2026Updated: March 19, 2026Remote Exploitable

Overview

WishList Member X <= 3.29.0 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

Severity & Score

Severity: High
CVSS Score: 8.8
EPSS Score: 0.0%(Probability of exploitation in next 30 days)

Impact

Attackers can execute arbitrary code or manipulate application logic via object injection.

Mitigation

Update to the latest version beyond 3.29.0.

References

Social Media Activity(4 posts)

TheHackerWire
TheHackerWire
@thehackerwire
Mar 19, 2026

šŸŸ  CVE-2026-25445 - High (8.8) Deserialization of Untrusted Data vulnerability in Membership Software WishList Member X allows Object Injection.This issue affects WishList Member X: from n/a through 3.29.0. šŸ”— https://www.thehackerwire.com/vulnerability/CVE-2026-25445/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post
TheHackerWire
TheHackerWire
@thehackerwire
Mar 19, 2026

šŸŸ  CVE-2026-25445 - High (8.8) Deserialization of Untrusted Data vulnerability in Membership Software WishList Member X allows Object Injection.This issue affects WishList Member X: from n/a through 3.29.0. šŸ”— https://www.thehackerwire.com/vulnerability/CVE-2026-25445/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post
TheHackerWire
TheHackerWire
@thehackerwire
Mar 19, 2026

šŸŸ  CVE-2026-25445 - High (8.8) Deserialization of Untrusted Data vulnerability in Membership Software WishList Member X allows Object Injection.This issue affects WishList Member X: from n/a through 3.29.0. šŸ”— https://www.thehackerwire.com/vulnerability/CVE-2026-25445/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post
TheHackerWire
TheHackerWire
@thehackerwire
Mar 19, 2026

šŸŸ  CVE-2026-25445 - High (8.8) Deserialization of Untrusted Data vulnerability in Membership Software WishList Member X allows Object Injection.This issue affects WishList Member X: from n/a through 3.29.0. šŸ”— https://www.thehackerwire.com/vulnerability/CVE-2026-25445/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

Details

CVE ID
CVE-2026-25445
Severity
High
CVSS Score
8.8
Type
insecure_deserialization
Status
new
EPSS
0.0%
Social Posts
4

CWE

  • CWE-502

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.0%Probability of exploitation in the next 30 days