Executive brief
The Remote API WordPress plugin, which provides programmatic access to site data, contains a critical security flaw in how it handles incoming requests. An attacker can send a specially crafted web request to a site using this plugin to execute unauthorized commands on the server. This could lead to a full takeover of the website, theft of sensitive data, or the installation of malicious software. There is currently no known fix for this issue, so site administrators should consider disabling the plugin.
Technical details
The Remote API plugin for WordPress (versions 0.2 and below) fails to authenticate requests before performing deserialization on user-supplied input. Specifically, the `Remote_API_Request::verify()` method in `request.php` calls `unserialize()` on the `remote-api` query parameter before performing HMAC or API-key validation. An unauthenticated attacker can provide a base64-encoded serialized PHP object; if a suitable POP gadget chain is available from other installed plugins or the environment (such as GuzzleHttp), the attacker can achieve remote code execution (RCE). As of the advisory date, no patch is available.
Affected products
- Unknown Remote API <= 0.2
Timeline
- 2026-07-09: disclosed: Publicly published via WPScan
- 2026-07-30: advisory: NVD publication date