CVE-2026-62021

Summary

A PHP object injection vulnerability in Angio plugin versions 1.1.1 and earlier allows authenticated attackers to inject malicious PHP objects, leading to potential remote code execution or data compromise.

Exploitability

Exploitation requires an authenticated user account with sufficient privileges, making it moderately difficult but achievable through social engineering or credential compromise.

Blast radius

If exploited, this vulnerability could affect all users of the affected WordPress site, potentially leading to full system compromise and data exfiltration across the entire WordPress installation.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Angio version 1.1.2 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.