ThemeREX Orpheus: PHP Object Injection by unauthenticated users
Summary
The WordPress theme Orpheus up to and including version 1.8 is affected by an unauthenticated PHP Object Injection vulnerability (CWE-502). An attacker on the network can send crafted data to the site without any account, which may allow manipulation of server-side processing and harmful actions on the server. NVD rates the issue as Critical (CVSS 3.1 9.8), while VulDB assigns 7.3; no vendor fix has been confirmed.
Affected
- WordPress theme Orpheus (ThemeREX) up to and including 1.8
- Some sources name a plugin instead of a theme; the product type needs verification on a real installation
Fixed in
- Unknown. No vendor advisory or fixed version has been confirmed.
- Check the Patchstack entry and the ThemeREX changelog for a version after 1.8.
Workaround
- Confirm whether the theme is installed and which version is active.
- Remove the theme if it is not needed.
- If it is needed, restrict access to the site where practical.
- Ask the managed WordPress or WAF provider whether a virtual patch is available.
- Keep the companion ThemeREX Addons plugin current.
Exploitation
- No evidence of exploitation in the wild found. The KEV status reported by a third-party aggregator is No; verify on the CISA catalogue.
- No public proof of concept found; VulDB states no exploit is available.
- CISA SSVC: Automatable yes, Technical Impact total.
- Patchstack describes the vulnerability as highly dangerous and expected to be exploited.
Our recommendation
- Inventory WordPress sites for the Orpheus theme and its version.
- Remove or isolate unused installations.
- On public sites still running 1.8 or earlier, apply mitigations and ask the vendor or hosting provider for a fix.
- Check the ThemeREX Addons plugin version as well.
- Review web server and application logs for unusual requests if a vulnerable site was exposed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- VulDB entry vuldb.com
- Vulners CVE record vulners.com
- ThemeForest product page themeforest.net
- ThemeREX Addons plugin advisory (CVE-2026-62105) hol.org
- ThemeREX Addons vulnerability fixed themerex.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:55.
Original description (NVD)
Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.