Juno WordPress theme: Unauthenticated PHP Object Injection
Summary
The Juno WordPress theme by ThemeREX, version 2.25 and earlier, contains an unauthenticated PHP Object Injection flaw (CWE-502) that is rated CRITICAL with CVSS 9.8. An attacker can send crafted serialized data to the website without logging in, which may allow manipulation of server-side processing and, depending on the classes available in the site's code, remote code execution. No official fixed version has been confirmed by the vendor, and sources disagree on the first fixed release. Juno is aimed at WooCommerce shops, which are often internet-facing.
Affected
- Juno theme for WordPress, versions 2.25 and earlier (Patchstack, NVD, Rapid7)
- Sites with the theme installed, including staging and agency-managed sites
Fixed in
- Unknown. Patchstack lists no official patch available.
- OpenCVE recommends upgrading to 2.26 or later, but this is not confirmed by Patchstack or ThemeREX.
- ThemeREX's download page lists version 2.28.0 as current, with an unclear page date.
- Verify the fixed version through the ThemeREX account or ThemeREX support.
Workaround
- No workaround is documented by the vendor.
- Deactivate the theme if it is not essential.
- Place a web application firewall or virtual patch in front of the site (Patchstack offers a mitigation rule).
- Restrict access to the admin area and frontend where feasible.
- Keep backups and review the site for unexpected changes.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC data: exploitation none, automatable yes, technical impact total.
- EPSS is very low, around 0.4 percent.
- No public proof of concept or reports of active exploitation were found. This is not an exhaustive check.
Our recommendation
- Inventory all WordPress sites using Juno, including staging and agency-managed sites.
- Confirm the installed theme version in the WordPress admin panel or theme files.
- If the site runs version 2.25 or earlier, treat it as urgent.
- Update to the latest version from the ThemeREX account, then confirm with ThemeREX or Patchstack that the fix is included.
- If no fix is confirmed, apply the workarounds above and monitor the Patchstack entry and the ThemeREX changelog.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- Rapid7 vulnerability record www.rapid7.com
- OpenCVE record app.opencve.io
- Hol Guard CVE record hol.org
- ThemeForest Juno item page themeforest.net
- ThemeREX Juno download page themerex.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:34.
Original description (NVD)
Unauthenticated PHP Object Injection in Juno <= 2.25 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.