{"id":"CVE-2026-62008","kind":"vulnerability","aliases":["CVE-2026-62008"],"related":[],"title":"Orpheus WordPress theme: unauthenticated PHP object injection lets attackers run code","description":"Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.","summary":"Orpheus, versions 1.8 and earlier, deserializes untrusted input into PHP objects without authentication. An attacker who sends a crafted request can trigger object injection, which can lead to arbitrary code execution on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Orpheus","fixed":[],"affected":"<= 1.8","ecosystem":"wordpress-theme"}],"ecosystems":[],"tags":["orpheus","php","runtime","self-hosted","wordpress","wordpress-theme"],"not_affected_if":["orpheus-not-installed","unknown","version-above-1.8"],"how_to_check":"In WordPress admin go to Appearance > Themes and open Orpheus; or run: wp theme list --name=orpheus --fields=name,version,status. Version 1.8 or lower is vulnerable. Also check for other plugins or themes that could supply a POP gadget chain.","fix":"No fixed version released as of 2026-10-29 (Patchstack: no official patch). Remove or replace the theme, or use a WAF virtual patch.","status":"open","published_at":"2026-10-29T16:18:13+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","triaged_at":"2026-10-29T16:27:27+00:00","updated_at":"2026-10-29T16:29:30+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-29T16:27:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Orpheus WordPress theme: unauthenticated PHP object injection lets attackers run code","impact":"high","summary":"Orpheus, versions 1.8 and earlier, deserializes untrusted input into PHP objects without authentication. An attacker who sends a crafted request can trigger object injection, which can lead to arbitrary code execution on the server.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["orpheus","php","wordpress"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the server through injected PHP objects","analyst_note":"Confirm product type, vulnerable entry point, and any fixed version from the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-62008.","how_to_check":"- Confirm whether the Orpheus product is installed and its version, which the sources do not state beyond `<= 1.8`\n- Check the installed version against `1.8`; versions at or below `1.8` are in the affected range","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Sites or applications running Orpheus at version 1.8 or earlier are in the affected range. The sources do not describe the exact entry point or required configuration, so teams should confirm whether their deployment exposes the vulnerable path.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000669,"input_tokens":4049,"output_tokens":529,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm product type, vulnerable entry point, and any fixed version from the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-62008.","search":"'-2026':13A,16A '-62008':14A,17A '1.8':31B,69C 'arbitrari':57B 'attack':9A,43B 'authent':41B 'code':11A,58B 'craft':47B 'cve':12A,15A 'deseri':34B 'earlier':33B 'execut':59B 'host':24B 'inject':7A,52B,66C 'input':36B 'lead':55B 'let':8A 'object':6A,39B,51B,65C 'orpheus':1A,18A,19B,29B,68C 'php':5A,20B,38B,64C 'request':48B 'run':10A 'runtim':21B 'self':23B 'self-host':22B 'send':45B 'server':62B 'theme':3A,28B 'trigger':50B 'unauthent':4A,63C 'untrust':35B 'version':30B,70C 'without':40B 'wordpress':2A,25B,27B 'wordpress-them':26B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the Orpheus theme at version 1.8 or earlier, active or merely installed, which accept unauthenticated requests that reach the theme's deserialization code. The theme alone has no known gadget chain, so remote code execution depends on another installed plugin or theme providing one. Sites not using Orpheus can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62008","severity":null,"published_at":"2026-10-29T16:18:13+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","fetched_at":"2026-10-29T16:26:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-62008:1043","url":null,"severity":null,"published_at":"2026-10-29T16:29:30+00:00","modified_at":"2026-10-29T16:29:30+00:00","first_seen_at":"2026-10-29T16:29:30+00:00","fetched_at":"2026-10-29T16:29:30+00:00","note":"Patchstack (CNA) and WordSec: Orpheus theme <= 1.8, unauthenticated PHP object injection (CWE-502), no patch as of Oct 2026, reported by johska. WordSec says no known POP chain in the theme itself, so code execution needs a gadget from another plugin or theme. Patchstack vPatch exists for its customers only. No vendor page found, so nothing marked verified. CVSS 9.8 (Patchstack) vs 8.1 (WordSec); kept the NVD/CNA value."}],"documents":[{"id":17735,"url":"https://patchstack.com/database/wordpress/theme/orpheus/vulnerability/wordpress-orpheus-theme-1-8-php-object-injection-vulnerability","title":"Patchstack: Orpheus Theme <= 1.8 PHP Object Injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":17737,"url":"https://wordsec.net/vulnerabilities/themes/orpheus/orpheus-18-unauthenticated-php-object-injection","title":"WordSec: Orpheus <= 1.8 Unauthenticated PHP Object Injection","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}