CVE-2026-14602

Name of the Vulnerable Software and Affected Versions Remote API WordPress plugin versions prior to 0.3

Description The plugin fails to authenticate requests before deserializing user-supplied input. This allows unauthenticated attackers to perform PHP Object Injection, a technique where malicious objects are injected into the application to manipulate its logic. If a POP chain (a sequence of gadgets used to execute arbitrary code) is present through another installed plugin or theme, this could lead to remote code execution, deletion of arbitrary files, or retrieval of sensitive data.

Recommendations Update the Remote API WordPress plugin to a version newer than 0.2.