CVE Intelligence
Analysis AI-assisted

CVE-2026-62052: ThemeREX Tipsy WordPress Theme - PHP Object Injection

CVE-2026-62052 is an unauthenticated PHP Object Injection flaw (CWE-502) in the Tipsy WordPress theme by ThemeREX, affecting versions up to and including 1.6. The CNA Patchstack reports a CVSS base score of 9.8 (critical), and the record lists no fixed version. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-62052 describes an unauthenticated PHP Object Injection vulnerability in the Tipsy WordPress theme published by ThemeREX. The weakness is classified as CWE-502 (Deserialization of Untrusted Data). The record was assigned by the CNA Patchstack and is currently in a Deferred source status.

Impact

Patchstack's record reports a CVSS 3.1 base score of 9.8 with a vector indicating network attack, low complexity, no privileges and no user interaction, with high confidence impact on confidentiality, integrity and availability. The SSVC fields in the record mark the issue as automatable with total technical impact. These are assessment inputs from the record, not a description of a demonstrated attack.

Affected products and versions

The record lists ThemeREX Tipsy with versions up to and including 1.6. The record does not provide a fixed version, and the absence of one does not confirm that no fix exists. Administrators should verify the installed theme version against the Patchstack entry and vendor channels.

Exploitation status

The CISA KEV catalog does not list this CVE in the record, so no active exploitation is claimed here. The EPSS probability is 0.00386 (percentile 0.31529) as of 2026-10-23, and the SSVC exploitation field is set to none. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Identify every site running the Tipsy theme and confirm the installed version.
  • Check the Patchstack entry and the theme vendor for an updated release; the record does not name one.
  • If no fix is available, consider temporarily disabling or replacing the theme and restricting access to affected sites through general hardening measures.
  • Keep WordPress core, plugins and themes updated and limit administrative access.

Detection guidance

  • Inventory installed themes and compare versions against the affected range.
  • Review web server and application logs for unusual requests to the theme and for unexpected serialized data in request parameters, at a high level.
  • Monitor for unexpected changes to site files or administrative accounts.

Limitations of the available information

The record does not include vendor advisory text, a fixed version, exploit maturity beyond the listed EPSS and SSVC values, or the exact vulnerable component or parameter. The CVSS source field references an email address rather than a URL, so the score is attributed to Patchstack as the CNA. Details should be confirmed in the Patchstack entry and vendor communications.

Frequently asked questions

What is CVE-2026-62052?

It is an unauthenticated PHP Object Injection vulnerability (CWE-502) in the Tipsy WordPress theme by ThemeREX, affecting versions up to and including 1.6.

Is this vulnerability known to be exploited?

The CISA KEV catalog does not list it in the record, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation field is none.

Is a fixed version available?

The record lists no fixed version. Check the Patchstack entry and the theme vendor for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.