Angio WordPress theme: PHP Object Injection by subscribers

Summary

The Angio WordPress theme up to and including version 1.1.1 is affected by PHP Object Injection (CWE-502). An authenticated user with the Subscriber role can supply crafted serialized data that the theme processes unsafely. Successful exploitation can lead to manipulation of data and, depending on other code installed on the site, remote code execution on the server.

Affected

• Angio WordPress theme version 1.1.1 and all earlier versions
• Vendor listed as rascals (not independently confirmed)

Fixed in

Unknown. No fixed version has been confirmed; the Patchstack entry lists no official patch.

Workaround

• No vendor workaround confirmed.
• Remove or deactivate the theme if it is not essential.
• Restrict or review accounts with the Subscriber role and disable open registration where possible.
• Keep WordPress core, other plugins and the PHP runtime fully updated.
• A WAF virtual patch may be available from a provider such as Patchstack; this is not confirmed for this CVE.

Exploitation

• Not known to be exploited in the wild; CISA SSVC lists exploitation as none and automatable as no.
• Not listed in CISA KEV according to a third-party alert feed.
• No public proof of concept found; this does not rule one out.
• EPSS about 0.0047 (low predicted exploitation probability).

Our recommendation

• Check whether the Angio theme is installed, including inactive copies.
• Check whether public registration is enabled; sites without open registration are much less exposed.
• If the theme is in use, remove or deactivate it until a fixed version is confirmed.
• Monitor the Patchstack advisory and the theme vendor for a fix, and apply it promptly.
• Review logs for unusual requests and recheck the NVD entry, which is currently deferred.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory: WordPress Angio theme <= 1.1.1 PHP Object Injection patchstack.com
• OpenCVE: CVE-2026-62021 app.opencve.io
• Rapid7 via Vulners: CVE-2026-62021 vulners.com
• Strix: CVE-2026-62021 www.strix.ai
• Patchstack Academy: PHP Object Injection patchstack.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:45.