A critical deserialization flaw (CVSS 9.8) in the Cotonti 1.0.0 Comments plugin lets unauthenticated attackers pass crafted serialized payloads through the ci GET parameter and reach PHP object injection. The advisory describes database manipulation and code execution as the outcomes this can lead to; no public proof-of-concept demonstrating code execution has been published, and whether injection escalates that far depends on the gadget chains available in a given deployment.
What Is It
The Comments plugin in Cotonti 1.0.0 passes the ci GET parameter directly to unserialize() without an allowed_classes restriction. That omission lets an unauthenticated attacker instantiate arbitrary PHP classes with attacker-controlled properties. From there, crafted serialized payloads can trigger gadget chains that lead to database manipulation or code execution.
The issue is classified as CWE-502 (Deserialization of Untrusted Data), and was disclosed through VulnCheck.
Why It Matters
The CVSS 3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A CVSS 4.0 score of 9.3 (CRITICAL) is also assigned. Every exploitability factor is worst-case: network attack vector, low attack complexity, no privileges required, and no user interaction. Confidentiality, integrity, and availability impacts are all rated HIGH.
In practical terms, that means anyone who can reach the comments functionality over the network can attempt exploitation; no account, no clicks, no social engineering. The reachable outcomes named in the advisory are database manipulation and code execution, which would put the entire site and its backing data at risk.
At the time of writing we found no entry for this CVE in the CISA Known Exploited Vulnerabilities catalog, and we are aware of no confirmed report of active exploitation or KEV-mandated remediation deadline. KEV is updated frequently, so operators should confirm the current status against the catalog directly rather than relying on this snapshot, and an absence there is not evidence of low risk given the exploitability profile.
What's Vulnerable
- Vendor/Product: Cotonti
- Affected version: 1.0.0 (and earlier per the advisory's
lessThanOrEqual: 1.0.0) - Affected component:
plugins/comments/inc/CommentsWidget.php - Package:
pkg:composer/cotonti/cotonti
Patch Status
The CVE record was published 2026-09-15 with a status of "Received," meaning NVD analysis is still pending. The supplied references point to an upstream issue (#1888) and a pull request (#1889) in the Cotonti repository; no fixed release version is stated in the source data. Operators running Cotonti 1.0.0 should track PR #1889 for the remediation.
Sources
- NVD, CVE-2026-91939: https://nvd.nist.gov/vuln/detail/CVE-2026-91939
- VulnCheck Advisory: https://www.vulncheck.com/advisories/cotonti-1.0.0-comments-plugin-php-object-injection-via-ci-parameter
- Cotonti Repository: https://github.com/Cotonti/Cotonti
- Affected file; CommentsWidget.php: https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/inc/CommentsWidget.php
- Cotonti Issue #1888: https://github.com/Cotonti/Cotonti/issues/1888
- Cotonti Pull Request #1889: https://github.com/Cotonti/Cotonti/pull/1889
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog