CVE Intelligence
Analysis AI-assisted

CVE-2026-62045: ThemeREX Booklovers WordPress theme - PHP Object Injection

The Booklovers WordPress theme by ThemeREX Group is affected by a PHP Object Injection issue caused by deserialization of untrusted data. The record lists affected versions from n/a through 2.13.0 and a CVSS base score of 9.8. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

This record describes a PHP Object Injection issue in the Booklovers WordPress theme by ThemeREX Group, caused by deserialization of untrusted data (CWE-502). Patchstack is the CNA, and the record status is Deferred. Patchstack's database entry is available at Patchstack entry.

Impact

  • The record assigns a CVSS base score of 9.8, which is rated critical.
  • The vector indicates network reachability, low attack complexity, no privileges required and no user interaction, with high confidentiality, integrity and availability impact.
  • The SSVC fields list exploitation as none, automatable as yes and technical impact as total.

Affected products and versions

  • Product: ThemeREX Group Booklovers (WordPress theme).
  • Range in the record: from n/a through 2.13.0.
  • The record lists no fixed version.

Exploitation status

  • CISA KEV does not list this CVE.
  • No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is 0.0032 (percentile 0.23769) as of 2026-10-23.

Remediation and mitigation

  • Identify all sites running the Booklovers theme and confirm the installed version.
  • Check the vendor and the Patchstack entry for a fixed release, since the record does not provide one.
  • Until a verified fix is applied, consider restricting access to affected sites, removing the theme if it is not needed, and applying general WordPress hardening practices.

Detection guidance

  • Review web server and application logs for unusual requests directed at the theme.
  • Monitor WordPress installations using this theme for unexpected administrative changes, new accounts or modified files.

Limitations of the available information

  • The record does not identify the vulnerable code path or any fixed version.
  • The record does not state whether the theme is distributed publicly or only sold.
  • Details beyond the record were not available for this analysis.

Frequently asked questions

Is this vulnerability being actively exploited?

CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The record lists the Booklovers theme from n/a through 2.13.0. It does not list a fixed version.

What should site owners do now?

Confirm the installed theme version, check the vendor and Patchstack entry for a fix, and limit exposure until a verified update is available.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.