CVE-2026-49781

The OttoKit: All-in-One Automation Platform WordPress plugin contains a vulnerability that allows malicious input to be deserialized as PHP objects in versions prior to 1.1.28, potentially enabling unauthenticated attackers to inject and manipulate system objects. This could lead to unauthorized actions such as deleting files or accessing sensitive data if other plugins or themes on the site are compromised by an additional attack vector.

Based on public CVE data (MITRE/NVD).