Splendour WordPress theme: Unauthenticated PHP Object Injection
Summary
The WordPress theme Splendour in versions 1.23 and earlier contains an unauthenticated PHP Object Injection flaw (CWE-502). An attacker can send a crafted serialized PHP payload that the theme unserializes, which may allow manipulation of server-side processing and, depending on available gadget chains, arbitrary code execution. No login is required, so any internet-facing WordPress site with this theme installed is at risk.
Affected
- ThemeREX Splendour WordPress theme, versions 1.23 and earlier (<= 1.23)
- Unknown whether the theme is active or only installed on a given site
Fixed in
- Unknown. No vendor-confirmed fixed version has been published for CVE-2026-62050.
- The vendor changelog lists version 1.27.0 with a related Object Injection fix in a different code path; it is not confirmed to cover this CVE.
Workaround
- Remove or deactivate the theme where it is not in use.
- Restrict admin and site access where possible and keep current backups.
- A web application firewall with virtual patching may help; no specific verified rule for this CVE is known.
- Monitor logs for unusual requests. No indicators of compromise are known.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC data: exploitation none, automatable yes, technical impact total.
- Rapid7 describes arbitrary code execution as possible; whether this is achievable depends on a usable gadget chain, which is not described in the sources.
- Patchstack expects exploitation, but this is a prediction, not evidence of active exploitation.
- No public proof of concept found.
Our recommendation
- Inventory all WordPress sites, including staging and forgotten sites, and check for the Splendour theme and its version.
- Remove or deactivate the theme where it is unused.
- Where the theme is needed, restrict exposure and apply a WAF virtual patch if available.
- Ask ThemeREX or Patchstack for the fixed version in writing and update once confirmed.
- Monitor logs and re-check the NVD and Patchstack records regularly, as the NVD status is still Deferred.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: WordPress Splendour theme <= 1.23 PHP Object Injection patchstack.com
- OpenCVE: CVE-2026-62050 app.opencve.io
- Rapid7 via Vulners: CVE-2026-62050 vulners.com
- ThemeForest: Splendour theme (vendor changelog) themeforest.net
- Threatint: CVE-2026-62050 cve.threatint.com
- HOL Guard: CVE-2026-62050 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:36.
Original description (NVD)
Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.