Live › vulnerability › CVE-2026-62003
The Mission WordPress theme (not a plugin), versions 1.22 and earlier, passes untrusted input to PHP unserialize() without authentication. No POP chain exists in the theme itself, but one in another installed plugin or theme could allow file deletion, data theft or code execution. No fixed version is known.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Sites running the Mission WordPress plugin at version 1.22 or earlier are exposed, since the flaw needs no login. The sources do not say which plugin features reach the vulnerable code, so any site with the plugin installed should be treated as exposed until its version is confirmed. Sites that do not have Mission installed are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| mission | wordpress-theme | <= 1.22 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in Mission <= 1.22 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-62003")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.