ThemeREX Mission WordPress theme: PHP Object Injection
Summary
The Mission WordPress theme up to version 1.22 contains an unauthenticated PHP Object Injection flaw (CWE-502). An attacker can send crafted data that the application unserializes, which can manipulate application logic and, depending on gadget chains available on the server, lead to code execution. Patchstack rates it CVSS 9.8 and high priority. Public websites are reachable from the internet by design, so exposure is high.
Affected
- Mission WordPress theme, version 1.22 and earlier (<= 1.22)
- Sources disagree on the component type (theme or plugin) and vendor name; verify on the site
Fixed in
Unknown. No official patch available as of 30 Oct 2026.
Workaround
- Patchstack has issued a virtual patch (mitigation rule) that blocks attacks; this is not a code fix
- Place a WAF rule in front of the site and restrict access to wp-admin and admin-ajax.php where possible
- Replace the theme with a maintained theme if it is not business-critical
Exploitation
- No confirmed exploitation in the wild found.
- Patchstack expects exploitation based on severity; this is a forecast, not an observation.
- Not listed in CISA KEV according to a GitHub triage issue; verify in the catalogue directly.
- No public proof-of-concept found.
Our recommendation
- Identify all sites running Mission 1.22 or earlier and check the theme name and version under Appearance > Themes.
- Prioritise public sites; treat as high priority while no fix is available.
- Replace the theme or keep the virtual patch active and a WAF in front of the site.
- Keep backups, monitor file integrity and check for unexpected PHP files.
- Re-check Patchstack and NVD daily for a vendor fix or signs of exploitation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack: WordPress Mission theme <= 1.22 PHP Object Injection patchstack.com
- Patchstack: Mission theme PHP Object Injection (canonical) patchstack.com
- CVE Brief: CVE-2026-62003 archive cvebrief.com
- GitHub triage issue (KEV status) github.com
- VulDB entry 428542 vuldb.com
- CVE-2026-62003 summary (threatint) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:02.
Original description (NVD)
Unauthenticated PHP Object Injection in Mission <= 1.22 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.