Live › vulnerability › CVE-2026-62008
Orpheus, versions 1.8 and earlier, deserializes untrusted input into PHP objects without authentication. An attacker who sends a crafted request can trigger object injection, which can lead to arbitrary code execution on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
WordPress sites running the Orpheus theme at version 1.8 or earlier, active or merely installed, which accept unauthenticated requests that reach the theme's deserialization code. The theme alone has no known gadget chain, so remote code execution depends on another installed plugin or theme providing one. Sites not using Orpheus can skip this.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Orpheus | wordpress-theme | <= 1.8 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-62008")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.