---
id: "CVE-2026-62003"
kind: "vulnerability"
aliases: ["CVE-2026-62003"]
title: "Mission WordPress plugin: unauthenticated PHP object injection up to 1.22"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "mission", "fixed": [], "affected": "<= 1.22", "ecosystem": "wordpress-theme"}]
ecosystems: []
tags: ["mission-plugin", "mission-theme", "package", "php", "wordpress", "wordpress-theme"]
not_affected_if: ["plugin-not-installed", "theme-not-installed"]
published_at: "2026-10-29T16:18:12+00:00"
first_seen_at: "2026-10-29T16:26:00+00:00"
updated_at: "2026-10-29T16:29:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62003", "first_seen_at": "2026-10-29T16:26:00+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T16:29:37+00:00"}]
---

# Mission WordPress plugin: unauthenticated PHP object injection up to 1.22

The Mission WordPress theme (not a plugin), versions 1.22 and earlier, passes untrusted input to PHP unserialize() without authentication. No POP chain exists in the theme itself, but one in another installed plugin or theme could allow file deletion, data theft or code execution. No fixed version is known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-theme:mission affected <= 1.22 fixed ?

## How to check

WordPress admin > Appearance > Themes: look for the Mission theme and check its version, or read the Version line in wp-content/themes/mission/style.css. Version 1.22 or lower is affected.

## Timeline

- 2026-10-29T16:26:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62003
- 2026-10-29T16:29:37+00:00 analyst — Triage said plugin; WPScan and Patchstack both list it as a THEME, <=1.22, no known fix, CVSS 8.1 (Wordfence) / 9.8 (Patchstack). NVD and Wordfence pages did not load; only third-party trackers read, so nothing marked verified. No exploitation seen. Affected: sites with the theme installed (even inactive); impact depends on a POP chain from other plugins/themes. Confirm with theme vendor if a fix appears.

## Documents

- [advisory] WPScan: Mission <= 1.22 Unauthenticated PHP Object Injection (theme, no known fix) https://wpscan.com/vulnerability/2139f974-1691-4467-90a3-83f12fd65b7e/
- [advisory] Patchstack: Mission theme <= 1.22 PHP Object Injection, no official patch https://patchstack.com/database/wordpress/theme/mission/vulnerability/wordpress-mission-theme-1-22-php-object-injection-vulnerability

## From the sources

Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_