Coinpress WordPress theme: Unauthenticated PHP Object Injection

Summary

The Coinpress WordPress theme up to and including version 1.0.15 contains a PHP Object Injection flaw (CWE-502) that can be triggered without authentication over the network. An attacker who can send crafted input to the affected site may manipulate how data is processed and potentially run harmful actions on the server. The NVD rates this CVSS 3.1 9.8 (Critical), while the VulDB score is 7.3 and Vulners lists 5.9, so the scores differ; plan using the higher value until the Patchstack advisory says otherwise.

Affected

• Coinpress WordPress theme, versions up to and including 1.0.15
• Vendor name is unconfirmed: ThemeREX per ThemeForest, meREX per VulDB

Fixed in

Unknown. No vendor fix is confirmed in the primary sources. Reseller pages mention version 1.0.16, but this is not verified as a fix for this CVE.

Workaround

• Unknown. No vendor-confirmed workaround was found.
• Deactivate or replace the theme on public sites.
• Restrict access to the administration area and sensitive functions.
• Use a WAF or virtual patching if available; coverage for this CVE is not verified.

Exploitation

• No evidence of exploitation in the wild found in the research; the CISA SSVC assessment lists exploitation as none, automatable as yes, technical impact as total.
• No public proof-of-concept found.
• Patchstack describes the flaw as highly dangerous and expected to be exploited; the CVE is part of a batch of similar WordPress theme disclosures.

Our recommendation

• Identify all WordPress sites running the Coinpress theme and record the installed version.
• Check the Patchstack advisory and the vendor changelog for a verified fixed version; do not rely on reseller pages.
• If no verified fix exists, plan to replace the theme on exposed public sites.
• Review logs and file integrity on sites that ran the theme while exposed, and take a backup before and after changes.
• Prioritise public sites; the risk is lower where the theme is inactive and its files are not reachable.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• VulDB entry vuldb.com
• Vulners CVE record vulners.com
• Strix CVE summary www.strix.ai
• ThemeForest listing themeforest.net

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:57.