Who is not affected by CVE-2026-62006?

Not affected if: managed-hosting-with-waf, theme-not-installed.

Live › vulnerability › CVE-2026-62006

critical9.8Package

Nuts: unauthenticated PHP object injection lets attackers run code

The Nuts WordPress theme (ThemeREX) up to and including 1.12 deserializes untrusted input without login, so anyone can inject PHP objects. The theme has no known gadget chain of its own. Code execution, file deletion or data theft is possible only if another installed plugin or theme provides one. No fixed release is reported.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 29, 2026 UTC
Last modified: Oct 29, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.

Who is affected

1 product

Product	Ecosystem	Affected	Fixed in
Nuts	wordpress-theme	<= 1.12	–

Who cares: deserialization, nuts, php, themerex, wordpress, wordpress-theme
Not affected if: managed-hosting-with-waf, theme-not-installed

How to check

In WordPress admin go to Appearance > Themes and check whether the Nuts theme is installed, even if inactive, and whether its version is 1.12 or lower
With WP-CLI: wp theme list (look for nuts, version <= 1.12)

The fix

No fixed version is published as of 2026-10-29
Remove or replace the Nuts theme
Until then, block the attack with a WAF rule (Patchstack has issued a mitigation rule for its customers)

Who had it, and when

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-62006

critical9.8Package

Nuts: unauthenticated PHP object injection lets attackers run code

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 29, 2026 UTC
Last modified: Oct 29, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.

Who is affected

1 product

Product	Ecosystem	Affected	Fixed in
Nuts	wordpress-theme	<= 1.12	–

Who cares: deserialization, nuts, php, themerex, wordpress, wordpress-theme
Not affected if: managed-hosting-with-waf, theme-not-installed

How to check

In WordPress admin go to Appearance > Themes and check whether the Nuts theme is installed, even if inactive, and whether its version is 1.12 or lower
With WP-CLI: wp theme list (look for nuts, version <= 1.12)

The fix

No fixed version is published as of 2026-10-29
Remove or replace the Nuts theme
Until then, block the attack with a WAF rule (Patchstack has issued a mitigation rule for its customers)

Who had it, and when

Know the next one before it finds you.

Add to Slack

Nuts: unauthenticated PHP object injection lets attackers run code

Who is affected

How to check

The fix

Who had it, and when

Know the next one before it finds you.

Nuts: unauthenticated PHP object injection lets attackers run code

Who is affected

How to check

The fix

Who had it, and when

Know the next one before it finds you.

What the sources say, verbatim

Sources