---
id: "CVE-2026-62008"
kind: "vulnerability"
aliases: ["CVE-2026-62008"]
title: "Orpheus WordPress theme: unauthenticated PHP object injection lets attackers run code"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Orpheus", "fixed": [], "affected": "<= 1.8", "ecosystem": "wordpress-theme"}]
ecosystems: []
tags: ["orpheus", "php", "runtime", "self-hosted", "wordpress", "wordpress-theme"]
not_affected_if: ["orpheus-not-installed", "unknown", "version-above-1.8"]
published_at: "2026-10-29T16:18:13+00:00"
first_seen_at: "2026-10-29T16:26:00+00:00"
updated_at: "2026-10-29T16:29:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62008", "first_seen_at": "2026-10-29T16:26:00+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T16:29:30+00:00"}]
---

# Orpheus WordPress theme: unauthenticated PHP object injection lets attackers run code

Orpheus, versions 1.8 and earlier, deserializes untrusted input into PHP objects without authentication. An attacker who sends a crafted request can trigger object injection, which can lead to arbitrary code execution on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-theme:Orpheus affected <= 1.8 fixed ?

## How to check

In WordPress admin go to Appearance > Themes and open Orpheus; or run: wp theme list --name=orpheus --fields=name,version,status. Version 1.8 or lower is vulnerable. Also check for other plugins or themes that could supply a POP gadget chain.

## Fix

No fixed version released as of 2026-10-29 (Patchstack: no official patch). Remove or replace the theme, or use a WAF virtual patch.

## Timeline

- 2026-10-29T16:26:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62008
- 2026-10-29T16:29:30+00:00 analyst — Patchstack (CNA) and WordSec: Orpheus theme <= 1.8, unauthenticated PHP object injection (CWE-502), no patch as of Oct 2026, reported by johska. WordSec says no known POP chain in the theme itself, so code execution needs a gadget from another plugin or theme. Patchstack vPatch exists for its customers only. No vendor page found, so nothing marked verified. CVSS 9.8 (Patchstack) vs 8.1 (WordSec); kept the NVD/CNA value.

## Documents

- [advisory] Patchstack: Orpheus Theme <= 1.8 PHP Object Injection https://patchstack.com/database/wordpress/theme/orpheus/vulnerability/wordpress-orpheus-theme-1-8-php-object-injection-vulnerability
- [describes] WordSec: Orpheus <= 1.8 Unauthenticated PHP Object Injection https://wordsec.net/vulnerabilities/themes/orpheus/orpheus-18-unauthenticated-php-object-injection

## From the sources

Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_