CVE-2026-14602 affects the Remote API WordPress plugin through version 0.2. The plugin fails to authenticate requests before deserializing user-supplied input, enabling unauthenticated attackers to inject arbitrary PHP objects. This deserialization vulnerability can lead to remote code execution if a suitable gadget chain exists within another installed plugin or library. No authentication is required to exploit this vulnerability, making it accessible to any unauthenticated attacker. The severity is high due to the potential for full server compromise via RCE. WordPress site administrators running this plugin should update or remove it immediately. The vulnerability is documented on both NVD and WPScan.