The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inje…

Published:

30 juli 2026 om 00:00:00

Alert date:

30 juli 2026 om 23:05:50

Source:

nvd.nist.gov

Web Technologies, Zero-Day Vulnerabilities

CVE-2026-14602 affects the Remote API WordPress plugin through version 0.2. The plugin fails to authenticate requests before deserializing user-supplied input, enabling unauthenticated attackers to inject arbitrary PHP objects. This deserialization vulnerability can lead to remote code execution if a suitable gadget chain exists within another installed plugin or library. No authentication is required to exploit this vulnerability, making it accessible to any unauthenticated attacker. The severity is high due to the potential for full server compromise via RCE. WordPress site administrators running this plugin should update or remove it immediately. The vulnerability is documented on both NVD and WPScan.

Technical details

Mitigation steps:

Affected products:

Remote API WordPress plugin 0.2