CVE-2026-62017

Summary

The plugin allows unauthenticated users to inject arbitrary PHP objects via serialized input, leading to remote code execution or data manipulation.

Exploitability

Exploitation requires no authentication and minimal skill due to the well-known nature of PHP object injection attacks.

Blast radius

An attacker could fully compromise the server, including stealing credentials, modifying content, or deploying backdoors.

Detection

Look for unexpected serialized PHP objects in POST or GET parameters targeting plugin endpoints, especially if accompanied by suspicious function calls (e.g., __wakeup, __destruct) in server logs or error logs.

Prioritized remediation

Upgrade to Good Homes version 1.3.14 or later, which contains a patch for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.