Edge Decor CVE-2026-62013

The target must be a WordPress site running the ThemeRex Edge Decor theme at version 2.9 or earlier. Exploitation is unauthenticated (CVSS PR:N) and requires no user interaction (UI:N), consistent with reaching a theme code path that deserializes attacker-controlled input. The practical limiting factor is that PHP Object Injection yields high impact (RCE/file operations) only when a usable POP gadget chain is present in the theme, active plugins, or WordPress core; the available sources do not describe the exact vulnerable endpoint or confirm such a chain. The dominant real-world constraint is deployment footprint - only sites with this specific theme installed and active are exposed.

Multiple severity signals point the same direction but are unevenly sourced. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity and availability impact, and the vuln.today decision label is act_now - the strongest urgency signal present. However, the deeper exploitation signals are absent: no CISA KEV entry is indicated (no confirmed active exploitation), no EPSS probability is provided (real-world exploitation likelihood cannot be quantified from this data), and no confirmed proof-of-concept or working exploit code is present - the sole reference is the Patchstack database advisory that reported the issue, which is a vendor/researcher writeup rather than verified exploit code. PHP Object Injection (CWE-502) is weaponizable to remote code execution only when a usable POP gadget chain exists in the theme or a loaded plugin/core; the available sources do not describe the trigger or confirm a gadget chain, so the C:H/I:H/A:H impact represents worst-case potential rather than a demonstrated outcome. Net: this is a genuine high-priority item for anyone running the affected theme (unauthenticated + act_now), but the combination of no KEV, no EPSS and an unverified PoC means the practical exploitation picture is 'serious-but-unproven' rather than 'confirmed under attack'. The limiting factor is product reach - Edge Decor is a niche commercial WordPress theme, so blast radius is narrow even though per-install severity is high.

A remote, unauthenticated attacker sends a crafted request to a WordPress site running the Edge Decor theme (<= 2.9) that reaches a vulnerable unserialize() call, injecting a malicious serialized PHP object. If a suitable POP gadget chain is reachable in the theme, plugins or core, the injected object can escalate to file operations or arbitrary code execution. No public working exploit is identified at time of analysis; the only reference is the Patchstack advisory, not verified exploit code.