{"id":"CVE-2026-62006","kind":"vulnerability","aliases":["CVE-2026-62006"],"related":[],"title":"Nuts: unauthenticated PHP object injection lets attackers run code","description":"Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.","summary":"The Nuts WordPress theme (ThemeREX) up to and including 1.12 deserializes untrusted input without login, so anyone can inject PHP objects. The theme has no known gadget chain of its own. Code execution, file deletion or data theft is possible only if another installed plugin or theme provides one. No fixed release is reported.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Nuts","fixed":[],"affected":"<= 1.12","ecosystem":"wordpress-theme"}],"ecosystems":[],"tags":["deserialization","nuts","package","php","themerex","wordpress","wordpress-theme"],"not_affected_if":["managed-hosting-with-waf","theme-not-installed"],"how_to_check":"In WordPress admin go to Appearance > Themes and check whether the Nuts theme is installed, even if inactive, and whether its version is 1.12 or lower. With WP-CLI: wp theme list (look for nuts, version <= 1.12).","fix":"No fixed version is published as of 2026-10-29. Remove or replace the Nuts theme. Until then, block the attack with a WAF rule (Patchstack has issued a mitigation rule for its customers).","status":"open","published_at":"2026-10-29T16:18:13+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","triaged_at":"2026-10-29T16:27:28+00:00","updated_at":"2026-10-29T16:29:41+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-29T16:27:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Nuts: unauthenticated PHP object injection lets attackers run code","impact":"high","summary":"Nuts versions 1.12 and earlier contain a PHP object injection flaw that needs no login. Based on the sources, an attacker who sends crafted input can make the application unserialize hostile objects.","audience":"businesses","category":"package","nicknames":[],"who_cares":["php","nuts"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker may execute code via object injection","analyst_note":"Check https://nvd.nist.gov/vuln/detail/CVE-2026-62006 and the Nuts project for the affected endpoint, gadget chain and a fixed release.","how_to_check":"- Check the installed Nuts version against the affected range (`1.12` and earlier).\n- unknown for other exposure checks: the sources do not say which endpoints or configuration are involved.","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown. The sources state only that unauthenticated PHP object injection affects Nuts versions up to and including 1.12, and do not describe the vulnerable data path or configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000638,"input_tokens":4047,"output_tokens":467,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check https://nvd.nist.gov/vuln/detail/CVE-2026-62006 and the Nuts project for the affected endpoint, gadget chain and a fixed release.","search":"'-2026':11A,14A '-62006':12A,15A '1.12':35B,86C 'anoth':68B 'anyon':42B 'attack':7A 'chain':53B 'code':9A,57B 'cve':10A,13A 'data':62B 'delet':60B 'deseri':17B,36B 'execut':58B 'file':59B 'fix':76B 'gadget':52B 'includ':34B 'inject':5A,44B,83C 'input':38B 'instal':69B 'known':51B 'let':6A 'login':40B 'nut':1A,18B,27B,85C 'nuts':16A 'object':4A,46B,82C 'one':74B 'packag':19B 'php':3A,20B,45B,81C 'plugin':70B 'possibl':65B 'provid':73B 'releas':77B 'report':79B 'run':8A 'theft':63B 'theme':25B,29B,48B,72B 'themerex':21B,30B 'unauthent':2A,80C 'untrust':37B 'version':87C 'without':39B 'wordpress':22B,24B,28B 'wordpress-them':23B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62006","severity":null,"published_at":"2026-10-29T16:18:13+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","fetched_at":"2026-10-29T16:26:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-62006:1044","url":null,"severity":null,"published_at":"2026-10-29T16:29:41+00:00","modified_at":"2026-10-29T16:29:41+00:00","first_seen_at":"2026-10-29T16:29:41+00:00","fetched_at":"2026-10-29T16:29:41+00:00","note":"Nuts is a ThemeREX WordPress theme, not a standalone PHP app. <=1.12 has unauthenticated PHP object injection (CWE-502). No known POP chain in the theme itself; RCE needs a gadget chain from another plugin or theme. No patch per Patchstack and WordSec (Wordfence-sourced). Only third-party DB pages read, no vendor page found, so nothing marked verified. CVSS 8.1 (Wordfence) vs 9.8 (Patchstack). No exploitation or PoC seen."}],"documents":[{"id":17738,"url":"https://patchstack.com/database/wordpress/theme/nuts/vulnerability/wordpress-nuts-theme-1-12-php-object-injection-vulnerability","title":"Patchstack: WordPress Nuts Theme <= 1.12 PHP Object Injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":17739,"url":"https://wordsec.net/vulnerabilities/themes/nuts/nuts-112-unauthenticated-php-object-injection","title":"WordSec: Nuts <= 1.12 Unauthenticated PHP Object Injection (Wordfence-sourced text)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}