Product
Meals & Wheels versions 1.1.13 and earlier are vulnerable to unauthenticated PHP object injection.