EUVD-2026-112981
GHSA-v8f6-j65h-jxr8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach vulnerable theme endpoint
-
DeliverySubmit malicious serialized payload
-
ExploitTrigger PHP object injection via unserialize
-
ExecutionInstantiate POP gadget chain
-
ImpactAchieve code execution or data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The flaw is untrusted PHP deserialization (CWE-502) in the Gunslinger WordPress theme at versions 1.11 and below; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) it is reachable remotely without authentication or user interaction against installations running the affected theme. The available sources do not name the exact parameter, endpoint, or configuration that reaches the unserialize call, so the precise trigger is not described. The practical limiting factor for PHP Object Injection is the availability of a usable POP gadget chain in the theme, WordPress core, or co-installed plugins to convert object injection into concrete impact (RCE, file read/write, or data tampering); the sources do not confirm such a chain exists. No fixed version is stated in the evidence. |
| Impact | Signals are mixed and the dataset is thin. The input CVSS is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating remote, unauthenticated, low-complexity exploitation with high confidentiality, integrity and availability impact - consistent with a PHP Object Injection (CWE-502) flaw that can yield code execution or data compromise given a suitable gadget chain. The vuln.today Decision label is act_now, reinforcing urgency. However, no EPSS score, no CISA KEV listing, and no SSVC decision-matrix values are present in the data, so the probabilistic and active-exploitation signals cannot be cross-checked - the high CVSS and act_now label are not corroborated by exploitation telemetry. There is no confirmed public exploit code (the single reference is a Patchstack advisory, not a PoC). Net: this is a credible high-severity issue warranting prompt remediation per the act_now label, but real-world risk is tempered by the narrow deployment footprint of a single commercial WordPress theme and by the fact that PHP Object Injection usually requires a reachable POP gadget chain, which the available sources do not confirm is present. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted input to the Gunslinger theme that is passed to PHP deserialization, injecting a malicious serialized object. If a usable POP gadget chain exists in the theme, WordPress core, or another installed component, the object injection can be escalated to file operations, data tampering, or remote code execution. No verified working exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
Gunslinger WordPress theme through version 1.11 exposes an unauthenticated PHP object injection issue that can let remote attackers supply serialized input to a PHP object deserialization path, carrying high confidentiality, integrity, and availability impact if a usable gadget chain is present. The CVSS vector confirms network reachability with no privileges or user interaction, but the exact vulnerable parameter or endpoint is not described in the available sources. No public exploit is identified at time of analysis, no fixed version is stated, and the vuln.today decision label is act_now.
RemediationAI
No vendor-released patch or fixed version is identified in the available evidence, so the referenced Patchstack advisory should be monitored for an updated release. Until a patched version is published, the specific compensating control is to deactivate and remove the Gunslinger theme from exposed WordPress installations and switch to a maintained theme; this changes site appearance and may break theme-specific functionality, so stage the change. Because the exact vulnerable endpoint is not described, targeted WAF or endpoint blocking cannot be reliably scoped from the available data; any generic PHP deserialization filtering would carry false-positive risk. If removal is not immediately possible, reduce exposure by taking the affected site offline or placing it behind access restrictions, accepting the availability and usability trade-offs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the ThemeREX Gunslinger WordPress theme, identified by CPE cpe:2.3:a:themerex:gunslinger:*:*:*:*:*:*:*:*, while the description scopes affected releases to 1.11 and below. CWE-502 covers deserialization of untrusted data in PHP: object injection occurs when attacker-controlled serialized data reaches an unserialize() call and can create objects of attacker-chosen classes. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms network reachability with no privileges or user interaction, but the sources do not identify the exact parameter, hook, AJAX action, or configuration that reaches the vulnerable deserialization. Concrete impact depends on a usable POP gadget chain in the theme, WordPress core, or co-installed plugins; the supplied evidence does not confirm one exists.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote deserialization (PR:N/UI:N/AV:N/AC:L); object injection enabling code execution supports high C/I/A with unchanged scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.
Executive ViewAI
CVE-2026-62018 is a critical unauthenticated PHP object injection vulnerability in the Gunslinger WordPress theme (versions through 1.11) that could allow remote attackers to compromise website confidentiality, integrity, and availability if a usable gadget chain is present. This affects any organization hosting a WordPress site using this theme, potentially exposing customer data, damaging brand trust, and disrupting online operations. Leadership should prioritize immediate mitigation because the vulnerability requires no authentication and has a critical severity rating.
No vendor-released patch identified at time of analysis; interim mitigations include disabling or removing the vulnerable theme, deploying WAF rules to block serialized input to PHP deserialization paths, restricting file permissions, and monitoring for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB