Filmax WordPress Theme CVE-2026-62009

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is remotely reachable without authentication or user interaction against a site running the Filmax WordPress theme version 1.1.11 or earlier. The principal limiting factor is inherent to PHP Object Injection: meaningful impact typically requires a reachable POP gadget chain in the theme, active plugins, or WordPress core, and the available sources do not describe the injection vector or confirm a usable gadget chain - so the trigger is not described in the available sources. Exploitation is further bounded to installations actually running the affected theme at <= 1.1.11.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical) describes a remotely reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity, and availability impact, and the vuln.today priority is act_now. However, the exploitation signals that normally corroborate a 9.8 are largely absent: no EPSS probability is provided, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is present in the data - only the Patchstack advisory itself. So the severity rating is high but the real-world exploitation evidence is thin and unconfirmed. Importantly, this is a PHP Object Injection (CWE-502) flaw, and the practical impact of such flaws usually depends on an exploitable POP gadget chain being reachable in the theme or its loaded plugins/WordPress core; the available sources do not describe the trigger or any confirmed gadget chain, so whether the full C:H/I:H/A:H impact is actually achievable in a default install is not verified here. Net: treat as a high-priority patching candidate given the act_now label and unauthenticated network vector, but note the gap between the maximal CVSS impact claim and the absence of EPSS/KEV/PoC evidence - this reads as a theoretically critical bug without confirmed active exploitation rather than a demonstrated mass-exploited threat.

A remote attacker sends a crafted request to a WordPress site running the Filmax theme (version 1.1.11 or earlier) containing a serialized PHP object in an attacker-controlled parameter, which the theme deserializes without authentication. If a usable POP gadget chain is present in the loaded code, this can lead to actions such as file operations, code execution, or data compromise. No public exploit code is identified in the provided data, and the exact injection point and required gadget chain are not described in the available sources.