CVE-2026-62105

CriticalCVSS 9.8

Published: 11/09/2026(UTC)Updated: 11/09/2026(UTC)Translated: 12/09/2026(UTC)NVD NIST

Summary

Unauthenticated PHP Object Injection in ThemeREX Addons versions below 2.45.0.

Risk Assessment

An unauthenticated attacker can exploit PHP Object Injection to perform unauthorized actions within the WordPress context, potentially leading to site takeover.

Recommendation

Update the ThemeREX Addons plugin to version 2.45.0 or later.

Other vulnerabilities in ThemeREX Addons

CVE-2025-60205Critical
There is an unauthenticated PHP Object Injection vulnerability in ThemeREX Addons versions <= 2.36.1.1.

Original NVD description (English source)

Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.