ThemeREX EmojiNation theme: PHP Object Injection without authentication
Summary
The WordPress theme EmojiNation up to and including version 1.0.12 contains a PHP Object Injection vulnerability (CWE-502). It can be triggered over the network without authentication. An attacker can manipulate how the site processes data, which may lead to harmful actions on the server. No fixed version has been confirmed, and NVD lists the status as Deferred.
Affected
- EmojiNation WordPress theme (ThemeREX), versions up to and including 1.0.12
Fixed in
Unknown. No fixed version is confirmed. The 1.0.13 changelog item in the ThemeForest listing concerns a different issue (CVE-2026-28029).
Workaround
- Unknown. No vendor mitigation is confirmed.
- Deactivate the theme and switch to another theme until a fixed version is confirmed.
Exploitation
- No public proof-of-concept or in-the-wild exploitation was found in the sources checked.
- Not listed in CISA KEV.
- Patchstack rates the issue as high priority and expects exploitation.
Our recommendation
- Identify all sites using the EmojiNation theme and their versions, including agency-built or customer-hosted sites.
- Deactivate or replace the theme on internet-facing sites if no fixed version is confirmed.
- Monitor for unexpected changes and unknown admin accounts.
- Re-check the Patchstack page and the ThemeForest changelog for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: WordPress EmojiNation theme <= 1.0.12 PHP Object Injection patchstack.com
- VulDB entry 428551 vuldb.com
- ThemeForest listing: EmojiNation themeforest.net
- Strix AI: CVE-2026-62014 www.strix.ai
- Threatint: CVE-2026-62014 cve.threatint.com
- Vulners: Patchstack entry for EmojiNation vulners.com
- ThemesInfo: EmojiNation theme themesinfo.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:51.
Original description (NVD)
Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.