---
id: "CVE-2026-62017"
kind: "vulnerability"
aliases: ["CVE-2026-62017"]
title: "Good Homes WordPress plugin: unauthenticated PHP object injection lets attackers run code"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["good-homes", "package", "php", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-29T16:18:14+00:00"
first_seen_at: "2026-10-29T16:26:01+00:00"
updated_at: "2026-10-29T16:27:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62017", "first_seen_at": "2026-10-29T16:26:01+00:00"}]
---

# Good Homes WordPress plugin: unauthenticated PHP object injection lets attackers run code

Good Homes versions up to 1.3.13 deserialize untrusted input without authentication, which is PHP object injection. An attacker who can reach the site without logging in may be able to trigger code execution or data access, depending on available gadget chains.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Good Homes plugin version in the WordPress admin under Plugins, or with `wp plugin get good-homes --field=version` if WP-CLI is available.
- Treat any version `1.3.13` or earlier as exposed.

## Fix

- Fixed version: unknown (the sources only state the affected range `<= 1.3.13`).

## Timeline

- 2026-10-29T16:26:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62017

## From the sources

Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_