Stargaze WordPress Theme CVE-2026-62051

Requires that the Stargaze WordPress theme version 1.10 or earlier is installed and active, and that the vulnerable code path passes attacker-controlled input to a PHP unserialize() call reachable without authentication. Per CVSS PR:N/UI:N, no login or user interaction is required and it works against default installations. The practical limiting factor is the need for a usable POP gadget chain (within the theme, a co-installed plugin, or WordPress core) for the object injection to produce meaningful impact such as code execution; without a suitable chain, impact may be reduced. Exploitation is further bounded to sites actually running this specific theme.

All signals point to a genuinely high-priority vulnerability, though exploitability depends on a factor the data cannot confirm. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with full C:H/I:H/A:H impact (9.8 Critical), and CWE-502 deserialization flaws routinely escalate to remote code execution. However, PHP Object Injection is only directly weaponizable when a suitable POP (property-oriented programming) gadget chain is present in the theme or a co-installed plugin/WordPress core; the single Patchstack reference does not confirm whether such a chain ships with Stargaze, so the practical jump from injection to RCE is INFERRED, not confirmed. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public POC is referenced, so this is no public exploit identified at time of analysis - there is no evidence of active or widespread exploitation despite the critical score. Net: treat as a real patch-now priority for anyone running the Stargaze theme because of the unauthenticated network vector, but recognize the real-world footprint is small (niche WordPress theme) and the CVSS reflects worst-case object-injection potential rather than a demonstrated exploit.

A remote, unauthenticated attacker sends a crafted request to a WordPress site running the Stargaze theme (<= 1.10) containing a malicious serialized PHP object in a parameter that the theme passes to unserialize(). If a usable gadget chain exists in the theme, an installed plugin, or WordPress core, the injected object triggers unintended method calls that can lead to file operations, SQL interaction, or arbitrary code execution. No public exploit code is referenced, so an attacker would need to identify a working POP chain for the target environment.