CVE-2026-62016

Summary

The Gamic plugin for WordPress before version 1.20 contains an unauthenticated PHP Object Injection vulnerability (CWE-502) in versions <= 1.19, allowing attackers to inject malicious serialized objects without authentication.

Exploitability

Exploitation is straightforward for remote attackers due to the lack of authentication requirements and low complexity.

Blast radius

Successful exploitation could lead to full system compromise including remote code execution, data exfiltration, or service disruption across any WordPress site using the affected Gamic plugin version.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Gamic version 1.20 or later, which contains the official patch for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.