Live › vulnerability › CVE-2026-62001
Marcell versions 1.2.14 and older accept attacker-supplied serialized PHP data without authentication. An attacker can use this to inject PHP objects, which can lead to code execution depending on the available classes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Any WordPress site with the Marcell (Personal Blog & Magazine) theme at 1.2.14 or older is exposed, with no login needed, because the theme deserializes untrusted input. Whether this reaches code execution depends on the classes loaded by other plugins and themes. Sites not using Marcell can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Marcell - Personal Blog & Magazine | wordpress-theme | <= 1.2.14 | – |
1.2.14 or older.1.2.14Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-62001")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.