What is the CVSS score of CVE-2026-14602?

CVE-2026-14602 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Remote API are affected by CVE-2026-14602?

The Remote API WordPress plugin (all versions through 0.2) contains a critical unauthenticated remote code execution vulnerability; publicly available exploit code exists.

Is there a public PoC exploit available for CVE-2026-14602?

Yes, a public proof-of-concept exploit is available for CVE-2026-14602. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-14602?

Within 24 hours: conduct a comprehensive inventory of all WordPress instances to identify Remote API plugin versions 0.2 and below by scanning wp-content/plugins directories and WordPress database plugin tables. Within 7 days: deactivate the plugin from the WordPress admin panel, physically remove all plugin files from affected servers, and confirm removal through filesystem audits and database verification. Within 30 days: if this plugin's functionality is business-critical, evaluate maintained alternative solutions or contact the developer for patched versions; forensically analyze WordPress audit logs and web server access logs for exploitation artifacts; implement automated vulnerability scanning in your CI/CD pipeline to prevent deployment of unmaintained or high-risk plugins.

Remote API CVE-2026-14602

EUVD-2026-50987 CRITICAL

Code Injection (CWE-94)

2026-07-30 WPScan

GHSA-2jcm-jwvc-6vhm

PHP WordPress RCE Code Injection Remote Api Unknown

9.0

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network reach (PR:N/AV:N) but RCE depends on an available gadget chain (AC:H); impact stays within the WordPress process so S:U, with full C/I/A compromise.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 22:30 vuln.today

CVSS changed

Jul 30, 2026 - 20:37 NVD

9.0 (None) 9.0 (CRITICAL)

CVE Published

Jul 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 06:00 cve.org

CRITICAL 9.0

DescriptionCVE.org

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remote API WordPress plugin through 0.2.

Articles & Coverage 1

News Critical PHP Object Injection in WordPress Remote API Plugin - CVE-2026-14602 Jul 31, 2026

AnalysisAI

PHP object injection in the Remote API WordPress plugin (all versions through 0.2) lets unauthenticated attackers deserialize attacker-supplied input, and when a suitable gadget chain is available it escalates to remote code execution on the host. The flaw stems from the plugin processing serialized user input before any authentication check. Publicly available exploit code exists (WPScan), though EPSS remains low (0.25%, 17th percentile) and it is not listed in CISA KEV.

Technical ContextAI

The vulnerability lives in a WordPress plugin that exposes a remote API endpoint. Rather than validating or authenticating callers, the plugin passes user-controlled data into PHP's unserialize() (or equivalent), instantiating arbitrary PHP objects from attacker-defined class/property data. Classified as CWE-94 (Code Injection) - here manifesting as PHP Object Injection (PHP's deserialization variant) - the actual code execution is not intrinsic to the deserialization itself but is realized through a 'gadget chain': a sequence of magic methods (__wakeup, __destruct, __toString) in loaded plugin/core/library code that, when triggered during object lifecycle, performs dangerous operations. The CPE is recorded as cpe:2.3:a:unknown:remote_api:*:*:*:*:*:*:*:* with the vendor unidentified, and tags confirm the RCE/WordPress/PHP/Code Injection profile.

RemediationAI

No vendor-released patch identified at time of analysis - the advisory covers all versions through 0.2 with no fixed version cited. Because reachability is the root cause, the most effective compensating control is to deactivate and remove the Remote API plugin until a patched release is confirmed, which fully eliminates the exposed deserialization endpoint at the cost of losing the plugin's remote API functionality. If the plugin must remain active, restrict network access to its API endpoint at the web server or WAF layer (allowlist trusted source IPs, or require an authenticating reverse proxy in front of the endpoint), accepting that this breaks any legitimate remote callers not on the allowlist; and add WAF rules to block request bodies containing serialized-PHP markers (e.g., 'O:' object patterns). Reduce gadget-chain availability by auditing and minimizing other installed plugins/themes, since RCE is only realized when a usable chain is present. Consult the WPScan advisory (https://wpscan.com/vulnerability/eb5a7d86-4762-48ad-83bf-81f048527147/) for updates and monitor for a release above 0.2.