{"id":"CVE-2026-62017","published":"2026-10-29T16:18:14.513","lastModified":"2026-10-29T18:17:34.470","description":"Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/good-homes/vulnerability/wordpress-good-homes-theme-1-3-13-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The plugin allows unauthenticated users to inject arbitrary PHP objects via serialized input, leading to remote code execution or data manipulation.","exploitability":"Exploitation requires no authentication and minimal skill due to the well-known nature of PHP object injection attacks.","blast_radius":"An attacker could fully compromise the server, including stealing credentials, modifying content, or deploying backdoors.","remediation":"Upgrade to Good Homes version 1.3.14 or later, which contains a patch for this vulnerability.","detection":"Look for unexpected serialized PHP objects in POST or GET parameters targeting plugin endpoints, especially if accompanied by suspicious function calls (e.g., __wakeup, __destruct) in server logs or error logs.","tags":["php-object-injection","unauthenticated","rce","web-application"],"model":"garnet-coder","analyzedAt":"2026-10-30T09:16:49.765Z"}}