CVE-2026-62125: Asia Garden WordPress theme - unauthenticated PHP Object Injection

Overview

The record describes an unauthenticated PHP Object Injection vulnerability in the Asia Garden WordPress theme, affecting versions up to and including 1.3.1. The weakness is classified as CWE-502, Deserialization of Untrusted Data. Patchstack is the CNA and published the entry on 2026-10-10; the record's source status is Deferred.

Impact

• The record rates the issue as critical, with a CVSS base score of 9.8.
• The vector indicates network reachability, low attack complexity, no privileges required, no user interaction, and high confidentiality, integrity and availability impact.
• The record does not describe the exact consequences of exploitation beyond the general class of PHP Object Injection. Impact on specific sites depends on the theme code path and the surrounding environment, which the sources do not detail.

Affected products and versions

• Product named in the record: ThemeREX Asia Garden (WordPress theme).
• Affected range as stated: up to and including 1.3.1.
• No fixed version is listed in the record. This does not confirm that no fix exists; it means the available data does not show one. See the Patchstack entry for vendor-side detail.

Exploitation status

• The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation is recorded there.
• The EPSS probability is 0.00313 (percentile 0.23037) as of 2026-10-23, and the SSVC exploitation field is none. These are estimates and indicators, not confirmation of attacks.
• No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

• Identify whether any WordPress site in your environment uses the Asia Garden theme, including child themes and staging copies.
• Where the theme is installed at version 1.3.1 or earlier, check the Patchstack entry and the theme vendor for an available update or official guidance before deciding on the response.
• If no fix is available, consider deactivating the theme or restricting public access to affected sites until a trusted remediation is published.
• Review and restrict plugins and components that handle serialized data, and keep WordPress core and other components current.

Detection guidance

• Review web server and application logs for unusual requests to the theme, especially those carrying serialized or encoded data in parameters, cookies or headers.
• Monitor for unexpected file changes, new administrative accounts or unexplained PHP errors referencing object handling.
• Track changes to the theme's status in vulnerability databases, since the record is marked Deferred and may be updated.

Limitations of the available information

• The record gives no fixed version, no proof-of-concept reference, and no detailed technical description of the vulnerable code path.
• The CVE and CVSS details come from the CNA and aggregated sources; the NVD entry is listed in the source pages but its enrichment is not detailed here.
• Whether the issue affects every installation or only specific configurations is unknown from the record.

Frequently asked questions

Is CVE-2026-62125 being actively exploited?

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted. The EPSS and SSVC values are estimates, not confirmation of attacks.

Which versions of the Asia Garden theme are affected?

The record states versions up to and including 1.3.1 are affected. It does not list a fixed version, so check the vendor and the Patchstack entry for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.