CVE-2026-14602

The CVE describes unauthenticated deserialization in the Remote API WordPress plugin (versions up to 0.2). An attacker can inject arbitrary PHP objects via a query parameter, potentially triggering remote code execution if a suitable gadget chain exists through another installed Remote API WordPr...