{"id":"CVE-2026-62005","kind":"vulnerability","aliases":["CVE-2026-62005"],"related":[],"title":"Muzicon WordPress theme: unauthenticated PHP object injection lets attackers run code","description":"Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.","summary":"Muzicon (Music Festival & Concert WordPress theme) 1.15 and earlier deserializes untrusted input, so unauthenticated visitors can inject PHP objects. The theme itself has no known gadget chain; impact (file deletion, data theft, code execution) depends on another plugin or theme on the site providing one. No patch exists yet.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"muzicon","fixed":[],"affected":"<= 1.15","ecosystem":"wordpress-theme"}],"ecosystems":[],"tags":["muzicon","package","php-object-injection","unauthenticated","wordpress","wordpress-theme"],"not_affected_if":["managed-hosting-with-waf-rule","theme-not-installed"],"how_to_check":"- WordPress admin: Appearance > Themes > Muzicon > Theme Details, or read 'Version:' in wp-content/themes/muzicon/style.css\n- Version 1.15 or earlier is vulnerable; no fixed version exists yet\n- Also check wp-content/themes and wp-content/plugins for other installed code, which supplies any usable gadget chain","fix":"No fixed version released as of 2026-10-29 (Patchstack, WPScan: 'no known fix'). Until one ships, deactivate and replace the Muzicon theme, or put a WAF/virtual-patch rule in front of the site.","status":"open","published_at":"2026-10-29T16:18:13+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","triaged_at":"2026-10-29T16:27:28+00:00","updated_at":"2026-10-29T16:29:34+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-29T16:27:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Muzicon WordPress theme: unauthenticated PHP object injection lets attackers run code","impact":"high","summary":"Muzicon versions 1.15 and earlier contain a PHP object injection flaw that accepts untrusted serialized data. An unauthenticated attacker can exploit it to run code or reach sensitive data on the affected site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","muzicon"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs on the server; site data readable without login","analyst_note":"Confirm the product platform (assumed WordPress theme), the fixed version, and the vulnerable code path from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-62005.","how_to_check":"- Check the installed Muzicon version in the theme's style.css or the WordPress admin Appearance page\n- Confirm whether the installed version is `1.15` or earlier\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000629,"input_tokens":4049,"output_tokens":449,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the product platform (assumed WordPress theme), the fixed version, and the vulnerable code path from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-62005.","search":"'-2026':13A,16A '-62005':14A,17A '1.15':36B,85C 'anoth':66B 'attack':9A 'chain':56B 'code':11A,62B 'concert':33B 'cve':12A,15A 'data':60B 'delet':59B 'depend':64B 'deseri':39B 'earlier':38B 'execut':63B 'exist':77B 'festiv':32B 'file':58B 'gadget':55B 'impact':57B 'inject':7A,24B,46B,82C 'input':41B 'known':54B 'let':8A 'music':31B 'muzicon':1A,18A,19B,30B,84C 'object':6A,23B,48B,81C 'one':74B 'packag':20B 'patch':76B 'php':5A,22B,47B,80C 'php-object-inject':21B 'plugin':67B 'provid':73B 'run':10A 'site':72B 'theft':61B 'theme':3A,29B,35B,50B,69B 'unauthent':4A,25B,43B,79C 'untrust':40B 'version':86C 'visitor':44B 'wordpress':2A,26B,28B,34B 'wordpress-them':27B 'yet':78B","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site with the Muzicon theme at version 1.15 or earlier installed, even if inactive, since theme files stay reachable on disk. Exploitation needs no login. Whether it becomes code execution depends on other installed plugins or themes that provide a usable gadget chain. Sites not using Muzicon, and with the theme removed from disk, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62005","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62005","severity":null,"published_at":"2026-10-29T16:18:13+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","fetched_at":"2026-10-29T16:26:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-62005:1045","url":null,"severity":null,"published_at":"2026-10-29T16:29:34+00:00","modified_at":"2026-10-29T16:29:34+00:00","first_seen_at":"2026-10-29T16:29:34+00:00","fetched_at":"2026-10-29T16:29:34+00:00","note":"Primary vendor advisory not found; NVD page unreadable via web-cli. Details from Patchstack (CVSS 9.8, no official patch) and WPScan/Wordfence (CVSS 8.1, AC:H since no POP chain in theme, no known fix). No exploitation or PoC seen. Nothing verified, since these are third-party databases. Severity kept critical per NVD/Patchstack 9.8 but Wordfence rates 8.1 high. Part of a mass disclosure of ThemeREX-style theme POI bugs on 2026-10-12."}],"documents":[{"id":17734,"url":"https://patchstack.com/database/wordpress/theme/muzicon/vulnerability/wordpress-muzicon-theme-1-15-php-object-injection-vulnerability","title":"Patchstack: Muzicon <= 1.15 PHP Object Injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":17736,"url":"https://wpscan.com/vulnerability/d423ff6e-98a9-40d7-9ba7-10a88ae00225/","title":"WPScan: Muzicon <= 1.15 Unauthenticated PHP Object Injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}