CVE Intelligence
Analysis AI-assisted

CVE-2026-62086: ThemeREX Juno WordPress theme - PHP Object Injection

The ThemeREX Juno WordPress theme up to and including 2.25 has an unauthenticated PHP Object Injection weakness classified as CWE-502. Patchstack reports a CVSS 3.1 base score of 9.8 (critical), and the record lists no fixed version. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes an unauthenticated PHP Object Injection issue in the ThemeREX Juno WordPress theme, affecting versions up to and including 2.25. The weakness is mapped to CWE-502 (Deserialization of Untrusted Data). The vulnerability entry is maintained by Patchstack, as shown in the Patchstack database entry.

Impact

  • The CVSS 3.1 base score of 9.8 (critical) from the record reflects high confidentiality, integrity and availability impact under the listed vector, which requires no privileges and no user interaction.
  • Deserialization of untrusted data can lead to unintended application behavior depending on the classes available to the application. The sources consulted do not detail the concrete consequences for this theme.

Affected products and versions

  • ThemeREX Juno WordPress theme, up to and including 2.25.
  • The record does not list a fixed version.

Exploitation status

This CVE is not listed in the CISA KEV catalog according to the record. No confirmed exploitation appears in the sources consulted. The SSVC exploitation field is recorded as none, and the EPSS probability is 0.00386 with percentile 0.31526, dated 2026-10-23.

Remediation and mitigation

  • Identify every installation of the Juno theme and confirm its version.
  • Check the Patchstack entry and the theme vendor for an updated release, since the record does not identify a fixed version.
  • If the theme is not needed, remove it from production sites.
  • Restrict exposure of affected sites where possible and keep verified backups before making changes.

Detection guidance

  • Review web server and application logs for unusual requests directed at the theme or at components that process serialized input, focusing on anomalies at a general level.
  • Monitor WordPress sites running the theme for unexpected file changes or unusual administrative account activity.

Limitations of the available information

  • The record does not provide a fixed version, technical details of the vulnerable code path, or any vendor advisory.
  • The CVSS source field contains an email address for Patchstack, which is treated here as the reporting party.
  • The sources consulted do not confirm exploitation activity, but this does not rule out unobserved exploitation.

Frequently asked questions

Which versions of the Juno theme are affected?

According to the record, the ThemeREX Juno WordPress theme is affected up to and including 2.25.

Is there a fixed version available?

The record does not list a fixed version. Check the Patchstack entry and the vendor for an updated release.

Is this vulnerability being actively exploited?

The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.