CVE-2026-62003

Summary

The Mission plugin for WordPress versions <= 1.22 contains an unauthenticated PHP Object Injection vulnerability (CWE-502) due to unsafe deserialization of user-supplied data, allowing attackers to inject malicious serialized objects that can lead to remote code execution or other critical impacts.

Exploitability

Exploitation is straightforward for attackers with network access since no authentication or user interaction is required (CVSS AV:N/AC:L/PR:N/UI:N).

Blast radius

Successful exploitation could allow full compromise of the affected WordPress site, including data theft, site defacement, or use as a pivot point for lateral movement within the infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Mission plugin version 1.23 or later, which contains the vendor-provided fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.