Live › vulnerability › CVE-2026-62011
Bonbon versions up to 1.11 deserialize attacker-supplied PHP objects without authentication. Successful exploitation can let an attacker run code or change data on the affected site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
WordPress sites with the Bonbon theme installed at version 1.11 or earlier, even if inactive-but-present files may be reachable; the flaw is reachable without login. On its own it has no known exploit chain; impact (code execution, data change) depends on another installed plugin or theme providing a POP chain. Sites without Bonbon can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Bonbon | wordpress-theme | <= 1.11 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-62011")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.