CVE-2026-62003

CriticalCVSS 9.8

Published: 29/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

34th percentile - higher than 34% of all known CVEs

Summary

PHP Object Injection vulnerability in the Mission theme in versions up to and including 1.22. It can be exploited by an unauthenticated attacker.

Risk Assessment

An unauthenticated attacker may inject a malicious PHP object, potentially leading to code execution or other serious impacts depending on available gadgets.

Recommendation

Update the Mission theme to a version newer than 1.22 or apply a mitigation if no update is available.

Other vulnerabilities in Mission

CVE-2025-69143High
Versions of Mission up to 1.22 are vulnerable to unauthenticated local file inclusion.

Original NVD description (English source)

Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS