CVE-2026-14602: Unknown Remote API

Critical severity, CVSS 9.0. EPSS: 0.7% chance of exploitation in the next 30 days.

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remote API WordPress plugin through 0.2.

Affected products

• Unknown Remote API: up to and including 0.2

Published 2026-07-30. Last modified 2026-07-30.