ThemeREX Booklovers theme: PHP Object Injection via untrusted deserialization

Summary

The Booklovers WordPress theme by ThemeREX Group, versions up to and including 2.13.0, deserializes untrusted data, which allows PHP Object Injection. Per the CNA, an unauthenticated remote attacker can manipulate how the site processes data and may run harmful actions on the server, depending on the PHP environment and the plugins and libraries present. No vendor fix or vendor advisory was found, and NVD analysis is still deferred.

Affected

• ThemeREX Group Booklovers WordPress theme, versions up to and including 2.13.0
• Earlier versions from the first release are affected per the CNA record (default: unaffected)

Fixed in

Unknown. No fixed version has been confirmed by the vendor or the CNA.

Workaround

• No vendor-confirmed workaround available.
• Deactivate and remove the theme where it is not needed.
• Consider a web application firewall or virtual patch from a provider that covers this entry (not verified for this CVE).

Exploitation

• No known exploitation in the wild; not listed in CISA KEV.
• CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
• No public proof-of-concept found; the search was limited.
• Patchstack rates it high priority and warns of possible mass exploitation.

Our recommendation

• Inventory all WordPress sites, including staging and forgotten sites, for the Booklovers theme.
• Deactivate and remove the theme where it is not required.
• Isolate or prioritise sites that still use it; restrict administrative access and keep recent backups.
• Monitor the Patchstack entry and ThemeREX channels and apply a fix as soon as one is confirmed.
• Check web server logs for unusual requests if the theme was installed on a public site.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• OpenCVE record app.opencve.io
• VulDB entry vuldb.com
• HOL Guard entry hol.org
• ThemeREX Booklovers documentation doc.themerex.net
• ThemeForest listing themeforest.net

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:00.