{"id":"CVE-2026-62017","kind":"vulnerability","aliases":["CVE-2026-62017"],"related":[],"title":"Good Homes WordPress plugin: unauthenticated PHP object injection lets attackers run code","description":"Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.","summary":"Good Homes versions up to 1.3.13 deserialize untrusted input without authentication, which is PHP object injection. An attacker who can reach the site without logging in may be able to trigger code execution or data access, depending on available gadget chains.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["good-homes","package","php","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Good Homes plugin version in the WordPress admin under Plugins, or with `wp plugin get good-homes --field=version` if WP-CLI is available.\n- Treat any version `1.3.13` or earlier as exposed.","fix":"- Fixed version: unknown (the sources only state the affected range `<= 1.3.13`).","status":"open","published_at":"2026-10-29T16:18:14+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","triaged_at":"2026-10-29T16:27:16+00:00","updated_at":"2026-10-29T16:27:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:27:16Z","model":"claude-haiku-5-5","output":{"fix":"- Fixed version: unknown (the sources only state the affected range `<= 1.3.13`).","reach":"internet","title":"Good Homes WordPress plugin: unauthenticated PHP object injection lets attackers run code","impact":"high","summary":"Good Homes versions up to 1.3.13 deserialize untrusted input without authentication, which is PHP object injection. An attacker who can reach the site without logging in may be able to trigger code execution or data access, depending on available gadget chains.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","good-homes","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker may run code on the server through object injection","analyst_note":"Confirm the fixed version and the vulnerable endpoint from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-62017) or the plugin vendor's changelog.","how_to_check":"- Check the installed Good Homes plugin version in the WordPress admin under Plugins, or with `wp plugin get good-homes --field=version` if WP-CLI is available.\n- Treat any version `1.3.13` or earlier as exposed.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Good Homes plugin at version 1.3.13 or earlier are exposed. The sources do not say which plugin features or endpoints are reached, so whether a site is reachable without authentication is unknown. Sites that do not have the plugin installed are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000703,"input_tokens":4053,"output_tokens":595,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-62017':15A,18A '1.3.13':30B,73C 'abl':53B 'access':60B 'attack':10A,42B 'authent':35B 'avail':63B 'chain':65B 'code':12A,56B 'cve':13A,16A 'data':59B 'depend':61B 'deseri':31B 'execut':57B 'gadget':64B 'good':1A,20B,25B,71C 'good-hom':19B 'home':2A,21B,26B,72C 'inject':8A,40B,69C 'input':33B 'let':9A 'log':49B 'may':51B 'object':7A,39B,68C 'packag':22B 'php':6A,23B,38B,67C 'plugin':4A 'reach':45B 'run':11A 'site':47B 'trigger':55B 'unauthent':5A,66C 'untrust':32B 'version':27B,74C 'without':34B,48B 'wordpress':3A,24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Good Homes plugin at version 1.3.13 or earlier are exposed. The sources do not say which plugin features or endpoints are reached, so whether a site is reachable without authentication is unknown. Sites that do not have the plugin installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62017","severity":null,"published_at":"2026-10-29T16:18:14+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","fetched_at":"2026-10-29T16:26:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}