CVE Intelligence
Analysis AI-assisted

CVE-2026-62050: WordPress Splendour theme

CVE-2026-62050 is a PHP Object Injection weakness (CWE-502) in the ThemeREX Splendour WordPress theme, reported for versions up to and including 1.23. The record describes it as unauthenticated and assigns a CVSS 3.1 base score of 9.8 (critical). No fixed version and no confirmed exploitation appear in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The Splendour theme for WordPress, from ThemeREX, is affected by a PHP Object Injection weakness (CWE-502, deserialization of untrusted data) in versions up to and including 1.23. According to the record, the flaw can be reached without authentication.

Impact

  • The CNA-assigned CVSS 3.1 base score is 9.8 (critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network attack, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
  • Deserialization of attacker-controlled data can generally lead to unintended code paths in an application. The concrete consequences for this theme are not detailed in the available record.

Affected products and versions

  • Product: ThemeREX Splendour, a WordPress theme.
  • Versions: 1.23 and earlier, up to and including 1.23.
  • No fixed version is listed in the sources consulted.

Exploitation status

  • The CISA KEV catalogue does not list this CVE in the record.
  • No confirmed exploitation in the wild appears in the sources consulted. The SSVC exploitation field is 'none', and EPSS is 0.00386 (percentile 0.31527), dated 2026-10-23.

Remediation and mitigation

  • Identify all installations of the Splendour theme and record the installed version.
  • Because no fixed version is listed, check the Patchstack entry and the vendor for current guidance, and update as soon as a fixed release is confirmed.
  • Until a fix is confirmed, reduce exposure where feasible, for example by limiting public access to affected sites and reviewing them with your WordPress security provider.

Detection guidance

  • Review web server and application logs for unusual requests to theme components and for unexpected serialized data in input parameters.
  • Monitor affected sites for unexpected file changes or newly created administrative accounts.

Limitations of the available information

  • The source status is 'Deferred', and the record provides no fixed version, no affected component names and no technical details beyond the class of weakness.
  • The CVSS source field contains an email address rather than a CNA name, so the provenance of the score should be verified against the Patchstack entry.
  • Whether the theme is still maintained is unknown from the record.

Frequently asked questions

Which Splendour versions are affected by CVE-2026-62050?

The record lists the ThemeREX Splendour theme for versions up to and including 1.23. No fixed version is listed in the sources consulted.

Is this CVE confirmed as actively exploited?

The record does not list it in the CISA KEV catalogue, and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.