CVE-2026-62123: WordPress Invetex Theme - PHP Object Injection
CVE-2026-62123 is a critical PHP Object Injection flaw (CWE-502) in the Invetex theme for WordPress, affecting versions up to and including 2.18. Patchstack scored it 9.8 under CVSS 3.1, and its vector indicates no privileges are required. The record lists no fixed version, and the CVE is not in the CISA KEV catalog.
Overview
The record describes an unauthenticated PHP Object Injection vulnerability in the Invetex theme for WordPress, affecting versions up to and including 2.18. It is classified as CWE-502, Deserialization of Untrusted Data. Patchstack is the CNA, and the record was published on 2026-10-10 with a source status of Deferred.
Impact
The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable issue with low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability. Deserialization flaws of this type can generally let an attacker influence application logic. The record does not detail the exact consequences in this theme.
Affected products and versions
- Product: ThemeREX Invetex
- Affected versions: up to and including 2.18, as stated in the record
- Fixed version: not listed in the record. This means the information is missing, not that no fix exists.
Exploitation status
The record shows the CVE is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00313 with a percentile of 0.23041 (dated 2026-10-23), and the SSVC exploitation field is none while automatable is yes. These signals indicate risk but are not evidence of active attacks.
Remediation and mitigation
- Identify all WordPress sites that use the Invetex theme and record the installed version.
- Because the record gives no fixed version, check the Patchstack entry and the vendor for current update status.
- If no fix is confirmed, consider replacing or disabling the theme through your organization's change process.
- Restrict access to administrative and sensitive areas of affected sites while remediation is pending.
Detection guidance
- Review web server and application logs for unusual requests directed at theme components.
- Use web application firewall or monitoring alerts for anomalous request bodies that resemble serialized data, at a general level.
- Track changes to theme files on affected sites.
Limitations of the available information
The record does not identify the vulnerable component or endpoint, does not list a fixed version, and does not provide vendor advisory details beyond the Patchstack reference. The NVD source status is Deferred, so enrichment may change. Scores should be re-checked against updated sources.
Frequently asked questions
Is CVE-2026-62123 being actively exploited?
The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Is a fixed version available?
The record lists no fixed version. Check the Patchstack entry and the vendor for current update status, since a missing value does not mean no fix exists.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.