Live › vulnerability › CVE-2026-62002
Meals & Wheels, a WordPress plugin, has an unauthenticated PHP object injection flaw in versions 1.1.13 and earlier. An attacker who sends crafted input can make the site deserialize hostile objects, which can lead to code execution on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Sites running the Meals & Wheels WordPress plugin at version 1.1.13 or earlier are exposed. The sources do not say whether any special configuration is required, so any site with the plugin installed should be treated as in scope.
No product ranges from the sources yet.
meals-wheels plugin folder's header.1.1.13; the sources do not name the exact fixed release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-62002")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.