Live › vulnerability › CVE-2026-62012
The Coinpress WordPress theme (ThemeREX) versions 1.0.15 and earlier deserialize untrusted PHP data without authentication. An attacker can use this PHP object injection to run code or take over the site. No patched version exists yet.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
WordPress sites with the ThemeREX Coinpress theme at version 1.0.15 or earlier are exposed, and the flaw is reachable without an account. The specific endpoint is not published. Sites that do not have this theme installed can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Coinpress | wordpress-theme | <= 1.0.15 | – |
In WordPress admin go to Appearance > Themes and check whether the Coinpress theme (ThemeREX) is installed, even if inactive, and its version; or read the Version line in wp-content/themes/coinpress/style.css. 1.0.15 or lower is affected.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-62012")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.