Live › vulnerability › CVE-2026-62017
Good Homes versions up to 1.3.13 deserialize untrusted input without authentication, which is PHP object injection. An attacker who can reach the site without logging in may be able to trigger code execution or data access, depending on available gadget chains.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Sites running the Good Homes plugin at version 1.3.13 or earlier are exposed. The sources do not say which plugin features or endpoints are reached, so whether a site is reachable without authentication is unknown. Sites that do not have the plugin installed are not affected.
No product ranges from the sources yet.
wp plugin get good-homes --field=version if WP-CLI is available.1.3.13 or earlier as exposed.<= 1.3.13).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-62017")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.