AIKIDO-2026-10606
automattic/zoninator is vulnerable to Insecure Deserialization
79
High Risk
This Affects:
automattic/zoninatorTL;DR
Zone details were stored by serializing an array into the term description and read back using maybe_unserialize. That makes the description field a high-traffic PHP deserialization sink. The fix replaces maybe_unserialize with an explicit is_serialized check and performs unserialize with allowed_classes=false, rejecting non-array results so attacker-controlled payloads cannot trigger PHP object instantiation/POP-gadget execution.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
automattic/zoninator is vulnerable to Insecure Deserialization in versions 0.0.1 - 0.10.2.
How to fix this
Upgrade the automattic/zoninator library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant