MaxSite CMS contains a critical PHP object injection vulnerability (CVE-2026-70554) that allows unauthenticated attackers to execute arbitrary code. The vulnerability exists because attacker-controlled serialized data in the maxsite_comuser cookie is passed directly to PHP's unserialize() function without any validation or class allowlisting. Attackers can craft a malicious serialized PHP object payload delivered in a single HTTP request. The exploit triggers magic methods during object graph reconstruction, enabling property-oriented programming (POP) attacks. Remote code execution is achievable via available gadget chains, including those targeting SoapClient or Imagick PHP extensions. No authentication is required, making this a high-severity unauthenticated RCE vector. The vulnerability was disclosed via NVD and VulnCheck advisories.