CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Payload: Prototype pollution in Payload Import Export plugin

Published Oct 6, 2026 · updated Oct 6, 2026

What to do

  1. Upgrade to a fixed version: @payloadcms/plugin-import-export 3.88.0, @payloadcms/plugin-import-export 4.0.0-canary.27.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

@payloadcms/plugin-import-export

>= 3.0.0, < 3.88.0
3.88.0

Check your project: npm ls @payloadcms/plugin-import-export --all

Is @payloadcms/plugin-import-export@3.88.0 safe to install? See the upgrade verdict →

@payloadcms/plugin-import-export

>= 4.0.0-canary.0, < 4.0.0-canary.27
4.0.0-canary.27

Check your project: npm ls @payloadcms/plugin-import-export --all

Is @payloadcms/plugin-import-export@4.0.0-canary.27 safe to install? See the upgrade verdict →

Sources

← All critical vulnerabilities