Thrive Apprentice: unauthenticated PHP object injection (CVE-2026-49107)
A vulnerability, CVE-2026-49107, with a CVSS score of 9.8 has been found in the Thrive Apprentice WordPress plugin. It is an unauthenticated PHP object injection, so no login is required to trigger it.
Checked in Shield: no
Who is affected
Sites running Thrive Apprentice versions below 10.8.10.2.
How to check
In the WordPress admin, open the Plugins page and check the installed Thrive Apprentice version. If it is below 10.8.10.2, the site is vulnerable.
How to fix
A fix is available in version 10.8.10.2. Update the plugin to that version or newer, preferably after taking a site backup.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Exploitation details and any evidence of attacks are not disclosed yet in the source (NVD).
