---
id: "CVE-2026-62006"
kind: "vulnerability"
aliases: ["CVE-2026-62006"]
title: "Nuts: unauthenticated PHP object injection lets attackers run code"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Nuts", "fixed": [], "affected": "<= 1.12", "ecosystem": "wordpress-theme"}]
ecosystems: []
tags: ["deserialization", "nuts", "package", "php", "themerex", "wordpress", "wordpress-theme"]
not_affected_if: ["managed-hosting-with-waf", "theme-not-installed"]
published_at: "2026-10-29T16:18:13+00:00"
first_seen_at: "2026-10-29T16:26:00+00:00"
updated_at: "2026-10-29T16:29:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62006", "first_seen_at": "2026-10-29T16:26:00+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T16:29:41+00:00"}]
---

# Nuts: unauthenticated PHP object injection lets attackers run code

The Nuts WordPress theme (ThemeREX) up to and including 1.12 deserializes untrusted input without login, so anyone can inject PHP objects. The theme has no known gadget chain of its own. Code execution, file deletion or data theft is possible only if another installed plugin or theme provides one. No fixed release is reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-theme:Nuts affected <= 1.12 fixed ?

## How to check

In WordPress admin go to Appearance > Themes and check whether the Nuts theme is installed, even if inactive, and whether its version is 1.12 or lower. With WP-CLI: wp theme list (look for nuts, version <= 1.12).

## Fix

No fixed version is published as of 2026-10-29. Remove or replace the Nuts theme. Until then, block the attack with a WAF rule (Patchstack has issued a mitigation rule for its customers).

## Timeline

- 2026-10-29T16:26:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62006
- 2026-10-29T16:29:41+00:00 analyst — Nuts is a ThemeREX WordPress theme, not a standalone PHP app. <=1.12 has unauthenticated PHP object injection (CWE-502). No known POP chain in the theme itself; RCE needs a gadget chain from another plugin or theme. No patch per Patchstack and WordSec (Wordfence-sourced). Only third-party DB pages read, no vendor page found, so nothing marked verified. CVSS 8.1 (Wordfence) vs 9.8 (Patchstack). No exploitation or PoC seen.

## Documents

- [advisory] Patchstack: WordPress Nuts Theme <= 1.12 PHP Object Injection https://patchstack.com/database/wordpress/theme/nuts/vulnerability/wordpress-nuts-theme-1-12-php-object-injection-vulnerability
- [describes] WordSec: Nuts <= 1.12 Unauthenticated PHP Object Injection (Wordfence-sourced text) https://wordsec.net/vulnerabilities/themes/nuts/nuts-112-unauthenticated-php-object-injection

## From the sources

Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_