CVE Intelligence
Analysis AI-assisted

CVE-2026-62046: WordPress Gutentype theme - PHP Object Injection

CVE-2026-62046 is a deserialization of untrusted data weakness (CWE-502) in the Gutentype WordPress theme by ThemeREX Group, which enables PHP object injection. The record lists the affected range as up to and including 2.1.12 and gives a critical CVSS base score of 9.8 from Patchstack. No fixed version and no confirmed exploitation appear in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Patchstack has published CVE-2026-62046, a deserialization of untrusted data weakness (CWE-502) in the Gutentype WordPress theme by ThemeREX Group. The flaw allows PHP object injection. The record lists the affected range as up to and including 2.1.12. See the Patchstack entry for the vendor database listing.

Impact

  • Patchstack scores the issue as critical, with a CVSS base score of 9.8 and a vector describing network reachability, no required privileges and no user interaction.
  • The SSVC data in the record rates technical impact as total and automatable as yes.
  • Object injection can lead to unexpected application behavior. The exact consequences for this theme are not described in the available information.

Affected products and versions

  • ThemeREX Group Gutentype, up to and including 2.1.12.
  • The record does not list a fixed version, so the absence of a fix in the data is not evidence that none exists.

Exploitation status

  • The CVE is not listed in the CISA KEV catalog according to the record.
  • No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is 0.0032 (percentile 0.2377) as of 2026-10-23. This is a statistical estimate, not evidence of attacks.

Remediation and mitigation

  • Identify every site running Gutentype and confirm the installed version.
  • Check the vendor or Patchstack entry for an updated release. If no fixed version is confirmed, consider replacing or disabling the theme.
  • Restrict access to administrative areas and consider a web application firewall as a compensating control, not as a substitute for a fix.
  • Maintain current backups before making changes.

Detection guidance

  • Review web server and application logs for unusual requests targeting theme components.
  • Monitor for unexpected file or configuration changes within the theme directory.
  • These are high-level indicators only; the record does not describe specific artifacts.

Limitations of the available information

  • The record does not include a vendor advisory text, a fixed version or technical details of the vulnerable code path.
  • The start of the affected range is listed as n/a.
  • Scores and EPSS values may change as sources are updated.

Frequently asked questions

Which Gutentype versions are affected by CVE-2026-62046?

According to the record, the affected range is up to and including 2.1.12, with the start of the range listed as n/a.

Is there a fixed version available?

The record does not list a fixed version. Check the vendor or the Patchstack entry for an updated release before deciding on next steps.

Is this vulnerability being actively exploited?

The CVE is not listed in CISA KEV according to the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.