Gunslinger WordPress theme: PHP Object Injection without authentication

Summary

The Gunslinger WordPress theme up to and including version 1.11 is affected by an unauthenticated PHP Object Injection flaw (CWE-502) rated CVSS 9.8 critical. An unauthenticated remote attacker can supply crafted serialized data to the website, which may lead to code execution or manipulation of data on the server, depending on the classes available in installed plugins. The theme is typically used for online shops, so internet-facing sites are most at risk.

Affected

• Gunslinger WordPress theme versions 1.11 and older (<= 1.11)
• Child themes and staging copies based on affected versions

Fixed in

• Unknown. No fixed version confirmed for CVE-2026-62018.
• Later releases (1.12.0, 1.14.0) exist, but it is not confirmed that they fix this CVE.

Workaround

• Deactivate the theme if it cannot be updated to a verified fixed version.
• Apply a WAF rule that blocks suspicious serialized input until a fix is verified.
• Remove unused WooCommerce and Elementor plugins, as object injection often depends on classes in installed code.
• Take a full backup before any change.

Exploitation

• Not listed in CISA KEV. EPSS not yet published.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• No public proof of concept or exploitation reports found at the time of research.
• Patchstack rates the flaw high priority and expects exploitation.

Our recommendation

• Check whether Gunslinger is installed, including child themes and staging sites, and identify the version.
• Treat sites running version 1.11 or older as urgent.
• Contact ThemeREX support or check the vendor changelog to confirm the fixed version, then update.
• If no fix can be applied, deactivate the theme and enable WAF protection.
• Check for signs of compromise such as unexpected admin users or modified theme files.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• Vulners Patchstack entry vulners.com
• ThemeForest Gunslinger item (changelog) themeforest.net
• ThemeREX Gunslinger documentation doc.themerex.net
• EPSS and exploitation status notes github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:53.