CVE-2026-62002

Summary

The Meals & Wheels plugin for WordPress versions <= 1.1.13 contains an unauthenticated PHP Object Injection vulnerability (CWE-502) due to unsafe deserialization of user-supplied data, allowing attackers to inject malicious serialized objects and potentially execute arbitrary code or cause denial of service.

Exploitability

Exploitation is straightforward for remote attackers since no authentication, user interaction, or special conditions are required (CVSS vector AV:N/AC:L/PR:N/UI:N).

Blast radius

Successful exploitation could lead to full system compromise including remote code execution, data exfiltration, and service disruption across any site running the affected plugin version.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Meals & Wheels version 1.1.14 or later, which contains the official patch for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.