Remote Api
Monthly
PHP object injection in the Remote API WordPress plugin (all versions through 0.2) lets unauthenticated attackers deserialize attacker-supplied input, and when a suitable gadget chain is available it escalates to remote code execution on the host. The flaw stems from the plugin processing serialized user input before any authentication check. Publicly available exploit code exists (WPScan), though EPSS remains low (0.25%, 17th percentile) and it is not listed in CISA KEV.
PHP object injection in the Remote API WordPress plugin (all versions through 0.2) lets unauthenticated attackers deserialize attacker-supplied input, and when a suitable gadget chain is available it escalates to remote code execution on the host. The flaw stems from the plugin processing serialized user input before any authentication check. Publicly available exploit code exists (WPScan), though EPSS remains low (0.25%, 17th percentile) and it is not listed in CISA KEV.