{"id":"CVE-2026-62004","kind":"vulnerability","aliases":["CVE-2026-62004"],"related":[],"title":"Motorix WordPress plugin: unauthenticated PHP object injection exposes sites","description":"Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.","summary":"Motorix versions 1.11 and earlier accept attacker-supplied serialized PHP data without authentication. Exploitation can allow an attacker to inject PHP objects, which may lead to code execution depending on available gadget chains.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["motorix","package","php","wordpress"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Motorix version in the plugin list or the plugin's main file header.","fix":"- Motorix: versions after `1.11` (the sources do not state a fixed version)","status":"open","published_at":"2026-10-29T16:18:13+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","triaged_at":"2026-10-29T16:27:29+00:00","updated_at":"2026-10-29T16:27:29+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T16:27:29Z","model":"claude-haiku-5-5","output":{"fix":"- Motorix: versions after `1.11` (the sources do not state a fixed version)\n- unknown","reach":"internet","title":"Motorix WordPress plugin: unauthenticated PHP object injection exposes sites","impact":"high","summary":"Motorix versions 1.11 and earlier accept attacker-supplied serialized PHP data without authentication. Exploitation can allow an attacker to inject PHP objects, which may lead to code execution depending on available gadget chains.","audience":"businesses","category":"package","nicknames":[],"who_cares":["motorix","php","wordpress"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker may run code on the server","analyst_note":"Confirm the affected product platform, a fixed version, and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-62004 for the vulnerable component and exploitation details.","how_to_check":"- Check the installed Motorix version in the plugin list or the plugin's main file header.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000632,"input_tokens":4047,"output_tokens":454,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-62004':12A,15A '1.11':22B,60C 'accept':25B 'allow':36B 'attack':27B,38B 'attacker-suppli':26B 'authent':33B 'avail':51B 'chain':53B 'code':47B 'cve':10A,13A 'data':31B 'depend':49B 'earlier':24B 'execut':48B 'exploit':34B 'expos':8A 'gadget':52B 'inject':7A,40B,57C 'lead':45B 'may':44B 'motorix':1A,16B,20B,59C 'object':6A,42B,56C 'packag':17B 'php':5A,18B,30B,41B,55C 'plugin':3A 'serial':29B 'site':9A 'suppli':28B 'unauthent':4A,54C 'version':21B,61C 'without':32B 'wordpress':2A,19B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62004","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62004","severity":null,"published_at":"2026-10-29T16:18:13+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","fetched_at":"2026-10-29T16:26:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}