Edge Decor WordPress theme: Unauthenticated PHP Object Injection
Summary
The Edge Decor WordPress theme up to and including version 2.9 contains an unauthenticated PHP Object Injection vulnerability (CWE-502). A remote attacker can send crafted serialized data to a vulnerable site without logging in, which can be used to manipulate server-side processing. Whether this leads to code execution depends on the gadget chains available in the theme and other installed plugins.
Affected
- Edge Decor theme (WordPress), versions 2.9 and earlier
- Vendor: ThemeREX (ThemeForest item)
Fixed in
Unknown.
- No confirmed patched version was found in the sources.
Workaround
Unknown.
- No verified vendor workaround. Ask the hosting provider or developer whether a fix or virtual patch (WAF rule) is available.
Exploitation
- Unauthenticated and remotely exploitable according to Patchstack and VulDB.
- CISA SSVC: automatable yes, exploitation none at time of assessment.
- No confirmed exploitation in the wild found; no public exploit found.
Our recommendation
- Check whether the Edge Decor theme is installed on any WordPress site and confirm the version.
- If installed and version 2.9 or earlier: plan replacement or deactivation of the theme until a fix is confirmed.
- Ask the hosting provider or developer about a fix or WAF rule.
- Review web server logs for unusual requests containing serialized data.
- Keep backups and monitor the vendor and Patchstack for an update.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-62013 patchstack.com
- VulDB entry 428552 vuldb.com
- Vulners CVE-2026-62013 vulners.com
- Vulners Patchstack entry vulners.com
- ThemeForest Edge Decor themeforest.net
- Third-party tracker (KEV status) github.com
- Patchstack PHP Object Injection academy patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:50.
Original description (NVD)
Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.