Marcell WordPress theme: Unauthenticated PHP Object Injection
Summary
The Marcell WordPress theme up to and including version 1.2.14 is affected by an unauthenticated PHP Object Injection flaw (CWE-502). An unauthenticated remote attacker can send crafted data to the site, which may let them manipulate how the site processes data and potentially run harmful actions on the server. NVD rates the issue 9.8 (Critical), while VulDB rates it 7.3. No vendor patch has been confirmed, and no public exploit or known in-the-wild use was found.
Affected
- Marcell WordPress theme, versions up to and including 1.2.14
- Vendor: ThemeREX (based on the ThemeForest listing; not verified on a vendor-owned page)
Fixed in
Unknown. No fixed version has been confirmed. The latest public changelog entry found is version 1.2.14 (21.04.2025).
Workaround
- No vendor-issued workaround is known.
- Patchstack may offer a virtual patch for high-priority issues; confirm availability for this CVE if you have a subscription.
Exploitation
- No public proof of concept known.
- No evidence of in-the-wild exploitation found; Strix lists KEV: No (CISA KEV not checked directly).
- Patchstack describes the flaw as likely to be exploited in mass campaigns.
- VulDB rates exploitation as easy (third-party assessment).
Our recommendation
- Check whether Marcell is installed on any site, including staging and old sites, and which version is used.
- If it is installed and no verified fixed version exists, plan a replacement theme, or remove the theme if unused.
- Ask your hosting provider or web developer about a virtual patch or WAF rule.
- Restrict or monitor access, keep backups, and review logs for unusual requests to the theme.
- Check the ThemeForest changelog and the vendor for any update.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- VulDB entry 428535 vuldb.com
- Strix CVE-2026-62001 www.strix.ai
- Vulners Patchstack record vulners.com
- ThemeForest Marcell listing themeforest.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:01.
Original description (NVD)
Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.