{"id":"CVE-2026-62001","kind":"vulnerability","aliases":["CVE-2026-62001"],"related":[],"title":"Marcell WordPress theme: unauthenticated PHP object injection in old versions","description":"Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.","summary":"Marcell versions 1.2.14 and older accept attacker-supplied serialized PHP data without authentication. An attacker can use this to inject PHP objects, which can lead to code execution depending on the available classes.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Marcell - Personal Blog & Magazine","fixed":[],"affected":"<= 1.2.14","ecosystem":"wordpress-theme"}],"ecosystems":[],"tags":["marcell","package","php","wordpress","wordpress-theme"],"not_affected_if":["newer-marcell-version","theme-not-installed"],"how_to_check":"- Check the installed Marcell version in the WordPress admin under Appearance > Themes, or in the theme's style.css header.\n- Confirm whether the installed version is `1.2.14` or older.","fix":"No patched version known as of 2026-10-29 (Patchstack: no official patch). Remove or replace the theme, or use a WAF/virtual patch, until the vendor ships a release above 1.2.14.","status":"open","published_at":"2026-10-29T16:18:12+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","triaged_at":"2026-10-29T16:27:31+00:00","updated_at":"2026-10-29T16:30:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:27:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Marcell WordPress theme: unauthenticated PHP object injection in old versions","impact":"high","summary":"Marcell versions 1.2.14 and older accept attacker-supplied serialized PHP data without authentication. An attacker can use this to inject PHP objects, which can lead to code execution depending on the available classes.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","marcell","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker may run code on the server via PHP object injection","analyst_note":"Check the NVD entry and the vendor or WordPress.org changelog for the fixed version and the vulnerable code path.","how_to_check":"- Check the installed Marcell version in the WordPress admin under Appearance > Themes, or in the theme's style.css header.\n- Confirm whether the installed version is `1.2.14` or older.","plain_action":"","needs_analyst":true,"not_affected_if":["newer-marcell-version"],"who_is_affected":"Sites running Marcell at `1.2.14` or older are in scope, based on the stated version range. The sources do not describe the exact vulnerable code path or which configurations are required, so whether a given site is reachable is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000651,"input_tokens":4051,"output_tokens":491,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and the vendor or WordPress.org changelog for the fixed version and the vulnerable code path.","search":"'-2026':12A,15A '-62001':13A,16A '1.2.14':30B,68C 'accept':33B 'attack':35B,43B 'attacker-suppli':34B 'authent':41B 'avail':60B 'blog':19A 'class':61B 'code':55B 'cve':11A,14A 'data':39B 'depend':57B 'execut':56B 'inject':7A,48B,65C 'lead':53B 'magazine':20A 'marcel':1A,21B,28B,67C 'marcell':17A 'object':6A,50B,64C 'old':9A 'older':32B 'packag':22B 'personal':18A 'php':5A,23B,38B,49B,63C 'serial':37B 'suppli':36B 'theme':3A,27B 'unauthent':4A,62C 'use':45B 'version':10A,29B,69C 'without':40B 'wordpress':2A,24B,26B 'wordpress-them':25B","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site with the Marcell (Personal Blog & Magazine) theme at 1.2.14 or older is exposed, with no login needed, because the theme deserializes untrusted input. Whether this reaches code execution depends on the classes loaded by other plugins and themes. Sites not using Marcell can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62001","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62001","severity":null,"published_at":"2026-10-29T16:18:12+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","fetched_at":"2026-10-29T16:26:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-62001:1050","url":null,"severity":null,"published_at":"2026-10-29T16:30:30+00:00","modified_at":"2026-10-29T16:30:30+00:00","first_seen_at":"2026-10-29T16:30:30+00:00","fetched_at":"2026-10-29T16:30:30+00:00","note":"No vendor/maintainer page found; Patchstack (CVSS 9.8, no official patch, virtual patch rule) and WordSec (unpatched) read, both third-party, so nothing marked verified. Vulnerable code path not published. Fix none per Patchstack; re-check WordPress.org/ThemeForest changelog."}],"documents":[{"id":17744,"url":"https://patchstack.com/database/wordpress/theme/marcell/vulnerability/wordpress-marcell-theme-1-2-14-php-object-injection-vulnerability","title":"Patchstack: Marcell theme <= 1.2.14 PHP Object Injection","kind":"advisory","source":"analyst","publisher":null,"text":"Marcell <= 1.2.14 vulnerable to unauthenticated PHP Object Injection, CVSS 9.8. No official patch available. Patchstack offers a virtual-patch mitigation rule. Published 12 Oct 2026.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":17745,"url":"https://wordsec.net/vulnerabilities/themes/marcell/marcell-personal-blog-magazine-wordpress-theme-1214-unauthenticated-php-object-injection","title":"WordSec: Marcell <= 1.2.14 unauthenticated PHP Object Injection","kind":"other","source":"analyst","publisher":null,"text":"Marcell - Personal Blog & Magazine theme <= 1.2.14, CWE-502, unauthenticated, status unpatched, reported by johska, 2026-10-12.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}