CVE-2026-62005

Summary

The Muzicon plugin for WordPress versions <= 1.15 contains an unauthenticated PHP Object Injection vulnerability (CWE-502) in its deserialization logic, allowing attackers to inject malicious serialized objects that can lead to remote code execution or data manipulation without requiring authentication.

Exploitability

Exploitation is straightforward for attackers due to the lack of authentication and direct exposure over the network; no prior access or user interaction is required.

Blast radius

Successful exploitation could result in full system compromise including unauthorized data access, modification of core application logic, or remote code execution on the affected WordPress site.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Muzicon version 1.16 or later, which contains a fix for the unauthenticated PHP Object Injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.