{"id":"CVE-2026-62003","kind":"vulnerability","aliases":["CVE-2026-62003"],"related":[],"title":"Mission WordPress plugin: unauthenticated PHP object injection up to 1.22","description":"Unauthenticated PHP Object Injection in Mission <= 1.22 versions.","summary":"The Mission WordPress theme (not a plugin), versions 1.22 and earlier, passes untrusted input to PHP unserialize() without authentication. No POP chain exists in the theme itself, but one in another installed plugin or theme could allow file deletion, data theft or code execution. No fixed version is known.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mission","fixed":[],"affected":"<= 1.22","ecosystem":"wordpress-theme"}],"ecosystems":[],"tags":["mission-plugin","mission-theme","package","php","wordpress","wordpress-theme"],"not_affected_if":["plugin-not-installed","theme-not-installed"],"how_to_check":"WordPress admin > Appearance > Themes: look for the Mission theme and check its version, or read the Version line in wp-content/themes/mission/style.css. Version 1.22 or lower is affected.","fix":null,"status":"open","published_at":"2026-10-29T16:18:12+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","triaged_at":"2026-10-29T16:27:31+00:00","updated_at":"2026-10-29T16:29:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T16:27:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Mission WordPress plugin: unauthenticated PHP object injection up to 1.22","impact":"high","summary":"The Mission plugin for WordPress, versions 1.22 and earlier, deserializes untrusted data into PHP objects without authentication. An attacker who can send a crafted request may be able to run code or take over the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","php","mission-plugin"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the server and reads site data","analyst_note":"Confirm the fixed version and the vulnerable code path from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-62003) and the plugin's changelog.","how_to_check":"- Look for the Mission plugin in the WordPress admin plugin list and note its version.\n- Check the plugin's version file or readme for a version at or below `1.22`.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Mission WordPress plugin at version 1.22 or earlier are exposed, since the flaw needs no login. The sources do not say which plugin features reach the vulnerable code, so any site with the plugin installed should be treated as exposed until its version is confirmed. Sites that do not have Mission installed are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000678,"input_tokens":4045,"output_tokens":547,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the vulnerable code path from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-62003) and the plugin's changelog.","search":"'-2026':12A,15A '-62003':13A,16A '1.22':10A,38B,85C 'allow':66B 'anoth':60B 'authent':48B 'chain':51B 'code':72B 'could':65B 'cve':11A,14A 'data':69B 'delet':68B 'earlier':40B 'execut':73B 'exist':52B 'file':67B 'fix':75B 'inject':7A,82C 'input':43B 'instal':61B 'known':78B 'mission':1A,17A,19B,22B,31B,84C 'mission-plugin':18B 'mission-them':21B 'object':6A,81C 'one':58B 'packag':24B 'pass':41B 'php':5A,25B,45B,80C 'plugin':3A,20B,36B,62B 'pop':50B 'theft':70B 'theme':23B,29B,33B,55B,64B 'unauthent':4A,79C 'unseri':46B 'untrust':42B 'version':37B,76B,86C 'without':47B 'wordpress':2A,26B,28B,32B 'wordpress-them':27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Mission WordPress plugin at version 1.22 or earlier are exposed, since the flaw needs no login. The sources do not say which plugin features reach the vulnerable code, so any site with the plugin installed should be treated as exposed until its version is confirmed. Sites that do not have Mission installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62003","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62003","severity":null,"published_at":"2026-10-29T16:18:12+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","fetched_at":"2026-10-29T16:26:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-62003:1046","url":null,"severity":null,"published_at":"2026-10-29T16:29:37+00:00","modified_at":"2026-10-29T16:29:37+00:00","first_seen_at":"2026-10-29T16:29:37+00:00","fetched_at":"2026-10-29T16:29:37+00:00","note":"Triage said plugin; WPScan and Patchstack both list it as a THEME, <=1.22, no known fix, CVSS 8.1 (Wordfence) / 9.8 (Patchstack). NVD and Wordfence pages did not load; only third-party trackers read, so nothing marked verified. No exploitation seen. Affected: sites with the theme installed (even inactive); impact depends on a POP chain from other plugins/themes. Confirm with theme vendor if a fix appears."}],"documents":[{"id":17732,"url":"https://wpscan.com/vulnerability/2139f974-1691-4467-90a3-83f12fd65b7e/","title":"WPScan: Mission <= 1.22 Unauthenticated PHP Object Injection (theme, no known fix)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":17733,"url":"https://patchstack.com/database/wordpress/theme/mission/vulnerability/wordpress-mission-theme-1-22-php-object-injection-vulnerability","title":"Patchstack: Mission theme <= 1.22 PHP Object Injection, no official patch","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}