Motorix WordPress theme: PHP Object Injection without authentication
Summary
The Motorix WordPress theme up to and including version 1.11 contains an unauthenticated PHP object injection flaw (CWE-502). An attacker can send crafted serialized data over the network without logging in, which may let them manipulate how the site processes data and run harmful actions on the server. Remote code execution is reported by a third-party aggregator but is not confirmed by the primary advisory, and whether it is exploitable depends on the code installed on each site.
Affected
- Motorix WordPress theme up to and including 1.11 (Patchstack: "<= 1.11")
- VulDB lists the component as a WordPress plugin (Motorix Plugin), so check whether the installed theme or the bundled plugin is affected
- Unknown: exact component and version ranges, pending the Patchstack advisory text
Fixed in
Unknown. No vendor advisory or patched release has been identified. Patchstack lists no official patch available.
Workaround
- Patchstack has issued a mitigation rule (virtual patch) if you use Patchstack protection
- Restrict access to administrative and form endpoints where practical
- Take a verified backup before any change
- Note: the theme may need to be removed or deactivated if no fixed version exists; this is an assumption to verify on your site
Exploitation
- No evidence of exploitation in the wild found; not listed in CISA KEV
- No public proof of concept found from a reputable researcher (VulDB: no available exploit)
- Patchstack expects exploitation and describes mass-exploit risk for this class of flaw
- EPSS not yet published
Our recommendation
- Check whether any site runs the Motorix theme or the Motorix plugin in version 1.11 or lower
- Treat internet-facing sites as urgent: apply a virtual patch or WAF rule, restrict access, or move the site to another theme
- Remove or deactivate the component if no fixed version is available
- Monitor for unexpected admin users, modified files and new PHP files in uploads
- Verify the CVSS score and status in the Patchstack advisory and NVD, as sources conflict (9.8, 8.1, 7.3, 5.9)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-62004 patchstack.com
- VulDB entry 428548 vuldb.com
- GitHub issue tracker entry CVE-2026-62004 github.com
- Strix CVE-2026-62004 www.strix.ai
- Vulners CVE-2026-62004 vulners.com
- ThemeREX Motorix product page themerex.net
- ThemeForest Motorix listing themeforest.net
- Motorix documentation (ThemeREX) doc.themerex.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:54.
Original description (NVD)
Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.