---
id: "CVE-2026-62002"
kind: "vulnerability"
aliases: ["CVE-2026-62002"]
title: "Meals & Wheels WordPress plugin: PHP object injection lets unauthenticated visitors run code"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["meals-wheels", "package", "php", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-29T16:18:12+00:00"
first_seen_at: "2026-10-29T16:26:00+00:00"
updated_at: "2026-10-29T16:27:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62002", "first_seen_at": "2026-10-29T16:26:00+00:00"}]
---

# Meals & Wheels WordPress plugin: PHP object injection lets unauthenticated visitors run code

Meals & Wheels, a WordPress plugin, has an unauthenticated PHP object injection flaw in versions 1.1.13 and earlier. An attacker who sends crafted input can make the site deserialize hostile objects, which can lead to code execution on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or in the `meals-wheels` plugin folder's header.

## Fix

- Move the Meals & Wheels plugin to a version later than `1.1.13`; the sources do not name the exact fixed release.

## Timeline

- 2026-10-29T16:26:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62002

## From the sources

Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_