Unauthenticated PHP Object Injection in WordPress Remote API

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remote API WordPress plugin through 0.2.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-14602 is a critical remote code execution vulnerability in the Remote API WordPress plugin that stems from unsafe deserialization of untrusted user input without proper authentication checks. The vulnerability allows attackers to inject malicious PHP objects that can be weaponized through gadget chains—sequences of existing code in installed plugins that, when chained together, execute arbitrary commands on the server. This affects any WordPress installation running the vulnerable Remote API plugin version 0.2 or earlier, making it particularly dangerous because the attack requires no credentials and can be triggered by unauthenticated users. The 9.0 CVSS score reflects the severity: complete system compromise is possible when suitable gadget chains exist in the plugin ecosystem.

Casky's 322 mapped skills leverage Claude's extended reasoning to detect the attack patterns behind this vulnerability across two critical MITRE ATT&CK techniques: TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would see findings highlighting suspicious deserialization operations on user-supplied input, absence of authentication token validation before object instantiation, and detection of PHP object gadget chain patterns. The platform's skills would flag requests to the Remote API endpoints that lack proper authorization headers, identify serialized object patterns in request payloads, and correlate these with known gadget chain indicators. Security teams would receive alerts on unusual PHP memory operations and class instantiation attempts that precede code execution, enabling them to catch exploitation attempts before malicious objects are fully deserialized and executed on their WordPress infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14602.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-14602

Casky has 322 skills that investigate the attack patterns behind CVE-2026-14602. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn