EUVD-2026-96183
GHSA-5vfq-q3vw-rcg2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Booklovers theme ≤2.13.0
-
DeliverySend crafted serialized payload to input vector
-
ExploitTrigger unserialize() object injection
-
ExecutionInvoke POP gadget chain methods
-
ImpactAchieve code execution or file tampering
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the ThemeREX Group 'Booklovers' WordPress theme version n/a through 2.13.0 to be installed and active. Exploitation sends attacker-controlled serialized data into a code path that calls PHP unserialize(); per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required against a default install. The practical limiting factor is that object injection only achieves meaningful impact (RCE, file write, deletion) when a reachable POP gadget chain exists in the theme, loaded plugins, or WordPress core - absent a usable gadget chain, impact is reduced to object instantiation with limited consequence. |
| Impact | This is a CWE-502 PHP Object Injection flaw in the WordPress 'Booklovers' theme by ThemeREX Group, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which indicates remote, network-reachable, unauthenticated exploitation with no user interaction and high impact to confidentiality, integrity, and availability. The CVSS vector contains PR:N, so exploitation is unauthenticated per the provided data. However, no EPSS probability, no CISA KEV listing, and no POC indicator were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 9.8 reflects theoretical worst-case impact, not demonstrated real-world weaponization. An important caveat: PHP object injection scores high because it can lead to RCE/file operations, but real impact is contingent on a usable POP gadget chain being reachable in the theme or its loaded plugins/core; if no gadget chain is present, practical impact may be substantially lower than the CVSS suggests. Given it is a niche commercial WordPress theme with no exploitation signals, this is a plausible-but-not-yet-prioritized issue: patch it, but it is lower urgency than a KEV-listed or high-EPSS flaw in a widely deployed product. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker submits crafted serialized PHP data to an input vector in the Booklovers theme that is passed to unserialize(). If a suitable POP gadget chain exists in the running WordPress stack, the injected object triggers malicious method calls on deserialization, potentially leading to arbitrary file write, SQL manipulation, or code execution. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in the ThemeREX Group 'Booklovers' WordPress theme (all versions through 2.13.0) lets remote attackers feed attacker-controlled serialized data into a PHP unserialize() call, which can corrupt or hijack application logic and, given a reachable gadget chain, escalate to code execution, arbitrary file write, or file deletion. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication or user interaction is required on a default install, and there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV). The practical severity ceiling depends on whether a usable POP gadget chain exists in the theme itself, its bundled plugins, or WordPress core - absent such a chain, exploitation is largely limited to object instantiation with constrained real-world impact.
RemediationAI
No vendor-released patch version is identified in the available data for CVE-2026-62045, so the primary action is to check the Patchstack advisory at https://patchstack.com/database/wordpress/theme/booklovers/vulnerability/wordpress-booklovers-theme-2-13-0-php-object-injection-vulnerability?_s_id=cve and the ThemeREX Group distribution channel for an updated Booklovers release and upgrade as soon as one is published; because there is no confirmed fixed version, do not assume that re-downloading 2.13.0 or earlier resolves the issue. Until a patched release is confirmed, the most effective compensating control is to deactivate and remove the Booklovers theme from production sites and switch to a maintained theme - the trade-off is a visual/functional redesign, but it removes the vulnerable code path entirely. If the theme must remain, restrict reachability of the affected endpoint (for example, block or challenge the request path carrying the serialized input at the WAF/reverse-proxy layer) and deploy WAF rules that detect PHP serialization markers such as 'O:' with class names in request bodies and parameters; these rules reduce but do not eliminate risk because encoding and parameter-name variation can bypass signature-based matching. Additional hardening includes keeping WordPress core and all plugins current so no exploitable POP gadget chain is available, disabling unused plugins and themes to shrink the gadget surface, enforcing least privilege on the database user, restricting PHP process write access to the web root to blunt file-write gadget chains, and monitoring wp-content/themes/booklovers and the uploads directory with file-integrity monitoring for unexpected PHP files. None of these compensating controls should be treated as a substitute for applying the vendor fix once it exists.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-502, Deserialization of Untrusted Data, implemented in PHP as object injection. The Booklovers theme passes attacker-influenced input into PHP's unserialize() function without adequate validation of the class graph being reconstructed. PHP's unserialize() honors the serialized representation of arbitrary objects, including magic methods such as __wakeup(), __destruct(), and __toString(), so an attacker who controls the serialized payload can trigger method invocations on classes already autoloaded in the WordPress runtime. The real-world exploitability of CWE-502 hinges on POP (property-oriented programming) gadget chains: if a class with a dangerous magic method is reachable, the injected object can chain into filesystem writes, SQL execution, or remote code execution; if no chain exists, the impact is limited to object instantiation. The affected package is identified by CPE cpe:2.3:a:themerex_group:booklovers:*:*:*:*:*:*:*:* - the ThemeREX Group Booklovers theme for WordPress, a third-party commercial theme, meaning the vulnerable code runs in the same process as the WordPress core and every active plugin, which expands the gadget surface beyond the theme alone. The issue was reported through the Patchstack vulnerability database, whose WordPress-theme advisories are used by the project to notify theme authors and downstream users.
Know when Booklovers gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization (PR:N, AV:N, AC:L) with object injection enabling high C/I/A impact when a POP gadget chain is present; scope unchanged.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.
Articles & Coverage 1
Executive ViewAI
The ThemeREX Group 'Booklovers' WordPress theme (all versions through 2.13.0) contains a critical unauthenticated PHP object injection vulnerability (CVE-2026-62045) that could allow remote attackers to compromise affected websites, potentially leading to code execution, arbitrary file write, or file deletion if a usable gadget chain exists. Organizations using this theme are at risk of full site takeover, data breaches, or defacement, though no public exploit code or active exploitation has been identified at this time. Leadership should prioritize immediate mitigation due to the lack of a vendor patch and the potential for severe business disruption.
Disable the Booklovers theme; deploy WAF virtual patching to block serialized PHP object injection attempts; restrict access to theme files and monitor for suspicious file modifications or new administrative accounts; apply input validation and sanitization to any custom code that processes serialized data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB