CVE-2026-62013

Summary

The Edge Decor plugin for WordPress before 2.9 contains an unauthenticated PHP object injection vulnerability (CWE-502), allowing remote attackers to inject malicious serialized objects via unsanitized user input, leading to arbitrary code execution or data manipulation.

Exploitability

Exploitation is straightforward for remote attackers due to the lack of authentication and low attack complexity.

Blast radius

Successful exploitation could lead to full system compromise including confidentiality, integrity, and availability impacts across any WordPress site running the affected Edge Decor plugin version.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Edge Decor version 2.9 or later, as this version contains the fix for the unauthenticated PHP object injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.