{"id":"CVE-2026-62002","kind":"vulnerability","aliases":["CVE-2026-62002"],"related":[],"title":"Meals & Wheels WordPress plugin: PHP object injection lets unauthenticated visitors run code","description":"Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.","summary":"Meals & Wheels, a WordPress plugin, has an unauthenticated PHP object injection flaw in versions 1.1.13 and earlier. An attacker who sends crafted input can make the site deserialize hostile objects, which can lead to code execution on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["meals-wheels","package","php","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in the `meals-wheels` plugin folder's header.","fix":"- Move the Meals & Wheels plugin to a version later than `1.1.13`; the sources do not name the exact fixed release.","status":"open","published_at":"2026-10-29T16:18:12+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","triaged_at":"2026-10-29T16:27:32+00:00","updated_at":"2026-10-29T16:27:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:27:32Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Meals & Wheels plugin to a version later than `1.1.13`; the sources do not name the exact fixed release.","reach":"internet","title":"Meals & Wheels WordPress plugin: PHP object injection lets unauthenticated visitors run code","impact":"high","summary":"Meals & Wheels, a WordPress plugin, has an unauthenticated PHP object injection flaw in versions 1.1.13 and earlier. An attacker who sends crafted input can make the site deserialize hostile objects, which can lead to code execution on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","meals-wheels","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the web server without logging in","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and the vulnerable endpoint; confirm whether the exploit needs any setting enabled.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in the `meals-wheels` plugin folder's header.\n- unknown for other checks; the sources do not say which endpoints or settings are involved.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Meals & Wheels WordPress plugin at version 1.1.13 or earlier are exposed. The sources do not say whether any special configuration is required, so any site with the plugin installed should be treated as in scope.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000697,"input_tokens":4059,"output_tokens":582,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-62002':15A,18A '1.1.13':39B,71C 'attack':43B 'code':12A,59B 'craft':46B 'cve':13A,16A 'deseri':52B 'earlier':41B 'execut':60B 'flaw':36B 'hostil':53B 'inject':7A,35B,67C 'input':47B 'lead':57B 'let':8A 'make':49B 'meal':1A,20B,25B,69C 'meals-wheel':19B 'object':6A,34B,54B,66C 'packag':22B 'php':5A,23B,33B,65C 'plugin':4A,29B 'run':11A 'send':45B 'server':63B 'site':51B 'unauthent':9A,32B,64C 'version':38B,72C 'visitor':10A 'wheel':2A,21B,26B,70C 'wordpress':3A,24B,28B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Meals & Wheels WordPress plugin at version 1.1.13 or earlier are exposed. The sources do not say whether any special configuration is required, so any site with the plugin installed should be treated as in scope.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62002","severity":null,"published_at":"2026-10-29T16:18:12+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","fetched_at":"2026-10-29T16:26:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}