CVE-2026-62002

Name of the Vulnerable Software and Affected Versions Meals & Wheels versions prior to 1.1.14

Description Unauthenticated attackers can perform PHP Object Injection due to the deserialization of untrusted input. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain via other installed plugins or themes could allow for arbitrary file deletion, retrieval of sensitive data, or remote code execution.

Recommendations Update to a version newer than 1.1.13.