CVE-2026-14602
Deferred Deferred - Pending Action

Unauthenticated PHP Object Injection in Remote API WordPress Plugin

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: WPScan

Description
The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remote API WordPress plugin through 0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-08-19
AI Q&A
2026-07-30
EPSS Evaluated
2026-08-18
NVD
CVE-2026-14602
EUVD
EUVD-2026-50987

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
remote_api remote_api_wordpress_plugin to 0.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-14602 is a PHP Object Injection vulnerability in the Remote API WordPress plugin version 0.2 or lower. It allows unauthenticated attackers to inject arbitrary PHP objects via the remote-api parameter, which are deserialized without proper authentication checks. This can lead to remote code execution if a suitable gadget chain exists in another installed plugin.

Detection Guidance

Check if the Remote API WordPress plugin version 0.2 or lower is installed. Look for suspicious requests containing the 'remote-api' query parameter with base64-encoded payloads. Monitor for unexpected file writes in the 'wp-content/uploads/' directory.

Impact Analysis

An attacker could exploit this to upload a web shell to your server's wp-content/uploads/ directory by sending a crafted request with a malicious PHP object. This would allow them to execute arbitrary commands on your server, potentially taking full control of your WordPress site and hosting environment.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules. A successful exploit may expose sensitive user data, resulting in legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Immediately remove or disable the Remote API WordPress plugin. Ensure no unauthorized files exist in 'wp-content/uploads/'. Block requests containing the 'remote-api' parameter at the firewall or server level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14602. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart