Live › vulnerability › CVE-2026-62013
Edge Decor versions 2.9 and earlier accept untrusted serialized PHP data without authentication. An attacker who can send it a crafted request may be able to run code or reach server data through object injection.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Sites running the Edge Decor plugin at version 2.9 or earlier are exposed, since the flaw needs no login. Sites without the plugin installed are not affected. The sources do not say whether non-default settings change exposure.
No product ranges from the sources yet.
2.9 or lower2.9; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-62013")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.