Live › vulnerability › CVE-2026-62005
Muzicon (Music Festival & Concert WordPress theme) 1.15 and earlier deserializes untrusted input, so unauthenticated visitors can inject PHP objects. The theme itself has no known gadget chain; impact (file deletion, data theft, code execution) depends on another plugin or theme on the site providing one. No patch exists yet.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Any WordPress site with the Muzicon theme at version 1.15 or earlier installed, even if inactive, since theme files stay reachable on disk. Exploitation needs no login. Whether it becomes code execution depends on other installed plugins or themes that provide a usable gadget chain. Sites not using Muzicon, and with the theme removed from disk, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| muzicon | wordpress-theme | <= 1.15 | – |
no known fix)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-62005")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.