{"id":"CVE-2026-62013","kind":"vulnerability","aliases":["CVE-2026-62013"],"related":[],"title":"Edge Decor WordPress plugin: unauthenticated PHP object injection up to 2.9","description":"Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.","summary":"Edge Decor versions 2.9 and earlier accept untrusted serialized PHP data without authentication. An attacker who can send it a crafted request may be able to run code or reach server data through object injection.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["edge-decor","package","php","wordpress"],"not_affected_if":["plugin-above-2.9","plugin-not-installed"],"how_to_check":"- Check the installed Edge Decor plugin version in the WordPress admin plugin list or the plugin's main file header\n- Confirm whether the installed version is `2.9` or lower","fix":"- Move Edge Decor to a version above `2.9`; the sources do not name the fixed version","status":"open","published_at":"2026-10-29T16:18:14+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","triaged_at":"2026-10-29T16:27:20+00:00","updated_at":"2026-10-29T16:27:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:27:20Z","model":"claude-haiku-5-5","output":{"fix":"- Move Edge Decor to a version above `2.9`; the sources do not name the fixed version\n- unknown whether a patched release is published","reach":"internet","title":"Edge Decor WordPress plugin: unauthenticated PHP object injection up to 2.9","impact":"high","summary":"Edge Decor versions 2.9 and earlier accept untrusted serialized PHP data without authentication. An attacker who can send it a crafted request may be able to run code or reach server data through object injection.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","edge-decor","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the server through injected PHP objects","analyst_note":"Confirm the fixed version and any patch or setting from the NVD entry and the plugin vendor; sources give only the range 2.9 and below.","how_to_check":"- Check the installed Edge Decor plugin version in the WordPress admin plugin list or the plugin's main file header\n- Confirm whether the installed version is `2.9` or lower\n- unknown whether the sources give a specific file or setting to inspect","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-above-2.9"],"who_is_affected":"Sites running the Edge Decor plugin at version 2.9 or earlier are exposed, since the flaw needs no login. Sites without the plugin installed are not affected. The sources do not say whether non-default settings change exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000692,"input_tokens":4051,"output_tokens":573,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-62013':14A,17A '2.9':11A,27B,66C 'abl':48B 'accept':30B 'attack':38B 'authent':36B 'code':51B 'craft':44B 'cve':12A,15A 'data':34B,55B 'decor':2A,20B,25B,65C 'earlier':29B 'edg':1A,19B,24B,64C 'edge-decor':18B 'inject':8A,58B,62C 'may':46B 'object':7A,57B,61C 'packag':21B 'php':6A,22B,33B,60C 'plugin':4A 'reach':53B 'request':45B 'run':50B 'send':41B 'serial':32B 'server':54B 'unauthent':5A,59C 'untrust':31B 'version':26B,67C 'without':35B 'wordpress':3A,23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Edge Decor plugin at version 2.9 or earlier are exposed, since the flaw needs no login. Sites without the plugin installed are not affected. The sources do not say whether non-default settings change exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62013","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62013","severity":null,"published_at":"2026-10-29T16:18:14+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","fetched_at":"2026-10-29T16:26:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}