EUVD-2026-112975
GHSA-v3c5-w69v-fmfc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted request to Coinpress endpoint
-
DeliverySupply malicious serialized PHP payload
-
ExploitTrigger unsafe deserialization (object injection)
-
ExecutionInstantiate objects invoking POP gadget chain
-
ImpactAchieve code execution or data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable against a WordPress site running the Coinpress theme at version 1.0.15 or earlier; per the CVSS vector (PR:N, UI:N) no authentication or user interaction is required, so it is reachable by remote unauthenticated attackers against a default install of the theme. The decisive limiting factor for real impact is specific to PHP Object Injection: the available sources do not name the vulnerable parameter/endpoint or confirm a reachable POP gadget chain, and object-injection flaws generally yield serious impact (file write/RCE) only when such a chain is present in the theme or co-installed plugins/core - absent that, impact may be limited to the deserialization itself. |
| Impact | At the metric level the severity signals align: the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes a remote, unauthenticated, low-complexity flaw with full confidentiality, integrity and availability impact, the vuln.today Decision label is act_now, and the finding is reported by Patchstack. However, key decision inputs are absent: no EPSS probability, no CISA KEV listing, and no PoC/exploit entry appear in the data, so exploitation likelihood cannot be quantified and there is no public exploit identified at time of analysis. The practical risk also carries a caveat the raw score hides: this is PHP Object Injection (CWE-502), and realistic impact (up to RCE) typically depends on a usable POP gadget chain being reachable in the theme or in co-installed plugins/core; the available sources do not describe the trigger or confirm an exploitable gadget chain, so C:H/I:H/A:H represents worst-case potential rather than independently verified impact. Net: a genuine high-priority patching item consistent with the act_now label, tempered by the missing EPSS/KEV data and the unverified gadget-chain dependency. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to a WordPress site running the Coinpress theme (<= 1.0.15) that passes attacker-controlled data into a PHP deserialization sink, instantiating arbitrary PHP objects. If a suitable POP gadget chain is reachable in the theme, plugins, or core, this can escalate to file operations or code execution; the specific entry point and trigger are not described in the available sources. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
Unauthenticated PHP object injection in the Coinpress WordPress theme through version 1.0.15 allows remote attackers to pass crafted serialized data to the theme, with the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicating full confidentiality, integrity, and availability impact and no authentication or user interaction requirement. The vuln.today Decision label is act_now and the finding is reported by Patchstack, but the available sources do not name the vulnerable parameter or endpoint and do not confirm a reachable POP gadget chain, so file-write or code-execution impact is conditional on such a chain existing in the theme, co-installed plugins, or WordPress core. No public exploit is identified in the supplied data.
RemediationAI
No vendor-released fixed version is identified in the supplied data; monitor the Patchstack advisory at https://patchstack.com/database/wordpress/theme/coinpress/vulnerability/wordpress-coinpress-theme-1-0-15-php-object-injection-vulnerability?_s_id=cve and upgrade Coinpress to the vendor's fixed release once it is published, since the affected range is through 1.0.15. If an immediate update is not possible, disable and remove the Coinpress theme from the WordPress installation, which eliminates the theme attack surface at the cost of losing the theme's presentation and any theme-dependent functionality; the available sources do not identify a parameter-level workaround or targeted virtual patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Coinpress is a WordPress theme distributed by ThemeREX, identified by CPE cpe:2.3:a:themerex:coinpress:*:*:*:*:*:*:*:*. The flaw is CWE-502 (Deserialization of Untrusted Data), the class in which attacker-controlled input reaches PHP's unserialize() and can instantiate objects; magic methods such as __wakeup or __destruct can then be invoked, and serious follow-on effects require usable gadget classes. The supplied CVSS vector confirms network reachability with AC:L, PR:N, and UI:N, but the trigger - the vulnerable parameter, endpoint, and any POP chain - is not described in the available sources, and the sources do not confirm whether co-installed plugins or core provide the needed classes.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote deserialization (PR:N/AV:N/AC:L/UI:N); object injection can yield full C/I/A impact where a gadget chain is reachable, consistent with the reported vector.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.
Executive ViewAI
CVE-2026-62012 is a critical unauthenticated PHP object injection vulnerability in the Coinpress WordPress theme (up to v1.0.15), enabling attackers to send crafted serialized data that could lead to full site compromise. This puts any organization hosting a WordPress site with this theme at risk of data theft, defacement, or malware distribution, potentially impacting customers and brand reputation. Leadership should prioritize immediate remediation because no patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations include deploying a web application firewall (WAF) to block malicious serialized payloads, disabling or removing the Coinpress theme until a fix is available, and ensuring all plugins and core are up to date to minimize gadget chain risk.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB