CVE Intelligence
Analysis AI-assisted

CVE-2026-62051: ThemeREX Stargaze WordPress theme - PHP Object Injection (CWE-502)

CVE-2026-62051 describes an unauthenticated PHP Object Injection flaw classified as CWE-502 in the Stargaze WordPress theme up to and including 1.10. Patchstack reports a CVSS base score of 9.8, which is critical. The record lists no fixed version and no confirmed exploitation in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-62051 is a PHP Object Injection vulnerability, mapped to CWE-502 (Deserialization of Untrusted Data), in the Stargaze theme for WordPress from ThemeREX. The record states that it affects versions up to and including 1.10 and can be triggered without authentication.

Impact

  • The CVSS base score reported by Patchstack is 9.8, rated critical.
  • The vector in the record marks confidentiality, integrity and availability impacts as high, so a successful abuse could affect the whole site.
  • Deserialization flaws of this kind can allow attackers to influence application logic; the exact outcome depends on the code and environment, which the record does not describe.

Affected products and versions

  • ThemeREX Stargaze WordPress theme, versions up to and including 1.10.
  • No fixed version is listed in the record, so whether a patched release exists is unknown.
  • Full details are kept in the Patchstack database entry.

Exploitation status

  • The vulnerability is not listed in the CISA KEV catalog in the record.
  • No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is 0.00386 (percentile 0.31528) as of 2026-10-23, and the SSVC exploitation value is none while automatable is yes. These are estimates, not evidence of attacks.

Remediation and mitigation

  • Inventory all WordPress sites using the Stargaze theme and record their installed version.
  • Where a site runs version 1.10 or earlier, plan an update as soon as the vendor publishes a fixed release, and check the vendor and Patchstack pages for that information.
  • If no fix is available, consider temporarily replacing or disabling the theme on exposed sites, and restrict access to administrative areas.
  • Maintain verified backups before making any change.
  • A web application firewall with rules maintained by the vendor or a security provider can reduce exposure while patching is pending.

Detection guidance

  • Review theme inventories and confirm whether Stargaze is installed and at which version.
  • Monitor web server and application logs for unusual requests targeting the theme, and investigate unexpected errors or behavior in the site.
  • Check for unauthorized file or content changes on affected sites as part of routine integrity reviews.

Limitations of the available information

  • The record does not provide a fixed version, a vendor advisory or technical exploitation details, and these points are unknown.
  • The record shows the source status as Deferred, so the assessment may change as more information is published.
  • The sources consulted do not confirm real-world exploitation; this does not rule it out.

Frequently asked questions

What is the vulnerability in CVE-2026-62051?

It is an unauthenticated PHP Object Injection flaw, classified as CWE-502, in the Stargaze WordPress theme up to and including 1.10.

Is there a fixed version?

The record does not list a fixed version, so whether a patched release exists is unknown. Check the vendor and the Patchstack entry for updates.

Is this vulnerability being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.