Live › vulnerability › CVE-2026-62014
EmojiNation, a WordPress plugin, lets an unauthenticated visitor inject serialized PHP objects, which can lead to code execution on the site. The NVD entry rates it critical with a CVSS score of 9.8, and the sources give no further detail.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Sites running the EmojiNation WordPress plugin at version 1.0.12 or earlier are exposed, because the flaw is reachable without logging in. Sites without this plugin, or running a newer version, are not affected. The sources do not say whether a non-default setting is required.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-62014")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.