{"id":"CVE-2026-62011","kind":"vulnerability","aliases":["CVE-2026-62011"],"related":[],"title":"Bonbon WordPress theme: unauthenticated PHP object injection, up to 1.11","description":"Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.","summary":"Bonbon versions up to 1.11 deserialize attacker-supplied PHP objects without authentication. Successful exploitation can let an attacker run code or change data on the affected site.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Bonbon","fixed":[],"affected":"<= 1.11","ecosystem":"wordpress-theme"}],"ecosystems":[],"tags":["bonbon","package","php-object-injection","theme","wordpress"],"not_affected_if":["bonbon-version-above-1.11","theme-not-installed"],"how_to_check":"Appearance > Themes, or the Version line in wp-content/themes/bonbon/style.css; 1.11 or lower is affected. With WP-CLI: wp theme list | grep bonbon","fix":"No fixed version published as of 2026-10-29. Remove or deactivate the Bonbon theme, or switch theme, until the vendor releases a fix; a WAF or Patchstack virtual patch can reduce risk.","status":"open","published_at":"2026-10-29T16:18:13+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","triaged_at":"2026-10-29T16:27:24+00:00","updated_at":"2026-10-29T16:28:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T16:27:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Bonbon WordPress theme: unauthenticated PHP object injection, up to 1.11","impact":"high","summary":"Bonbon versions up to 1.11 deserialize attacker-supplied PHP objects without authentication. Successful exploitation can let an attacker run code or change data on the affected site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","bonbon"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker may run code on the site server","analyst_note":"Confirm the affected product (WordPress theme vs other), the fixed version and the exploit path at https://nvd.nist.gov/vuln/detail/CVE-2026-62011.","how_to_check":"- Check the installed Bonbon version in the theme's style.css or the WordPress Appearance > Themes screen\n- Treat any site running Bonbon `1.11` or earlier as in scope\n- Sources do not name a specific code path to inspect","plain_action":"","needs_analyst":true,"not_affected_if":["theme-not-installed"],"who_is_affected":"Sites running the Bonbon theme at version 1.11 or earlier are described as affected, per the NVD description. The sources do not say which configuration or request path is needed beyond the lack of authentication. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00066,"input_tokens":4049,"output_tokens":510,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the affected product (WordPress theme vs other), the fixed version and the exploit path at https://nvd.nist.gov/vuln/detail/CVE-2026-62011.","search":"'-2026':12A,15A '-62011':13A,16A '1.11':10A,30B,60C 'affect':52B 'attack':33B,44B 'attacker-suppli':32B 'authent':38B 'bonbon':1A,17A,18B,26B,59C 'chang':48B 'code':46B 'cve':11A,14A 'data':49B 'deseri':31B 'exploit':40B 'inject':7A,23B,57C 'let':42B 'object':6A,22B,36B,56C 'packag':19B 'php':5A,21B,35B,55C 'php-object-inject':20B 'run':45B 'site':53B 'success':39B 'suppli':34B 'theme':3A,24B 'unauthent':4A,54C 'version':27B,61C 'without':37B 'wordpress':2A,25B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the Bonbon theme installed at version 1.11 or earlier, even if inactive-but-present files may be reachable; the flaw is reachable without login. On its own it has no known exploit chain; impact (code execution, data change) depends on another installed plugin or theme providing a POP chain. Sites without Bonbon can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62011","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62011","severity":null,"published_at":"2026-10-29T16:18:13+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","fetched_at":"2026-10-29T16:26:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-62011:1042","url":null,"severity":null,"published_at":"2026-10-29T16:28:46+00:00","modified_at":"2026-10-29T16:28:46+00:00","first_seen_at":"2026-10-29T16:28:46+00:00","fetched_at":"2026-10-29T16:28:46+00:00","note":"Patchstack and WordSec (secondary; no vendor page found) say Bonbon WordPress theme <=1.11 unpatched, no official fix. Not verified: no vendor/maintainer source. No exploitation or PoC seen. No POP chain in theme itself."}],"documents":[{"id":17726,"url":"https://patchstack.com/database/wordpress/theme/bonbon/vulnerability/wordpress-bonbon-theme-1-11-php-object-injection-vulnerability","title":"Patchstack: WordPress Bonbon Theme <= 1.11 PHP Object Injection","kind":"advisory","source":"analyst","publisher":null,"text":"Bonbon <= 1.11 vulnerable. No official patch available. CVSS 9.8. Patchstack issued a virtual patch rule for its customers. Published 12 Oct 2026.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":17727,"url":"https://wordsec.net/vulnerabilities/themes/bonbon/bonbon-111-unauthenticated-php-object-injection","title":"WordSec: Bonbon <= 1.11 Unauthenticated PHP Object Injection","kind":"blog","source":"analyst","publisher":null,"text":"Unpatched. Reported by johska. Unauthenticated PHP object injection in all versions <= 1.11. No known POP chain in the theme itself; exploitation needs a POP chain from another installed plugin or theme.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}