CVE-2026-110369 is a deserialization flaw in the WordPress Team Members plugin by GS Plugins that allows PHP object injection.
It affects versions through 2.8.2, with a CVSS score of 8.8. No exploitation in the wild is confirmed.
GS Plugins fixed it in version 2.8.3. Sites running the plugin should update.