{"id":"CVE-2026-62012","kind":"vulnerability","aliases":["CVE-2026-62012"],"related":[],"title":"Coinpress: unauthenticated PHP object injection lets attackers run code","description":"Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.","summary":"The Coinpress WordPress theme (ThemeREX) versions 1.0.15 and earlier deserialize untrusted PHP data without authentication. An attacker can use this PHP object injection to run code or take over the site. No patched version exists yet.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Coinpress","fixed":[],"affected":"<= 1.0.15","ecosystem":"wordpress-theme"}],"ecosystems":[],"tags":["coinpress","package","php","theme","themerex","wordpress"],"not_affected_if":["plugin-not-installed","theme-not-installed"],"how_to_check":"In WordPress admin go to Appearance > Themes and check whether the Coinpress theme (ThemeREX) is installed, even if inactive, and its version; or read the Version line in wp-content/themes/coinpress/style.css. 1.0.15 or lower is affected.","fix":"No patched version available per Patchstack. Remove or replace the Coinpress theme until ThemeREX ships a fix.","status":"open","published_at":"2026-10-29T16:18:13+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","triaged_at":"2026-10-29T16:27:23+00:00","updated_at":"2026-10-29T16:28:13+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-29T16:27:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Coinpress: unauthenticated PHP object injection lets attackers run code","impact":"high","summary":"Coinpress versions 1.0.15 and earlier accept untrusted serialized PHP data without authentication. An attacker can use this PHP object injection to run code or take over the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","php","coinpress"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the server through injected objects","analyst_note":"Confirm the fixed Coinpress version and the vulnerable endpoint from the plugin's changelog or the NVD entry.","how_to_check":"- Check the installed Coinpress version in the WordPress plugin list or the plugin's main file header; it is affected at `1.0.15` and below.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Coinpress plugin at version 1.0.15 or earlier are exposed, and the flaw is reachable without an account. The sources do not say which endpoints or settings are involved. Sites that do not run Coinpress can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000644,"input_tokens":4053,"output_tokens":478,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed Coinpress version and the vulnerable endpoint from the plugin's changelog or the NVD entry.","search":"'-2026':11A,14A '-62012':12A,15A '1.0.15':29B,65C 'attack':7A,39B 'authent':37B 'code':9A,48B 'coinpress':1A,16A,17B,24B,64C 'cve':10A,13A 'data':35B 'deseri':32B 'earlier':31B 'exist':57B 'inject':5A,45B,62C 'let':6A 'object':4A,44B,61C 'packag':18B 'patch':55B 'php':3A,19B,34B,43B,60C 'run':8A,47B 'site':53B 'take':50B 'theme':20B,26B 'themerex':21B,27B 'unauthent':2A,59C 'untrust':33B 'use':41B 'version':28B,56B,66C 'without':36B 'wordpress':22B,25B 'yet':58B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the ThemeREX Coinpress theme at version 1.0.15 or earlier are exposed, and the flaw is reachable without an account. The specific endpoint is not published. Sites that do not have this theme installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62012","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62012","severity":null,"published_at":"2026-10-29T16:18:13+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","fetched_at":"2026-10-29T16:26:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-62012:1041","url":null,"severity":null,"published_at":"2026-10-29T16:28:13+00:00","modified_at":"2026-10-29T16:28:13+00:00","first_seen_at":"2026-10-29T16:28:13+00:00","fetched_at":"2026-10-29T16:28:13+00:00","note":"Patchstack (CNA) lists Coinpress as a ThemeREX WordPress THEME, not a plugin, <=1.0.15, no official patch as of 2026-10-29; Patchstack mitigation rule exists for its customers. Endpoint not disclosed. No exploitation or PoC seen; not searched X."}],"documents":[{"id":17723,"url":"https://patchstack.com/database/wordpress/theme/coinpress/vulnerability/wordpress-coinpress-theme-1-0-15-php-object-injection-vulnerability","title":"Patchstack: WordPress Coinpress Theme <= 1.0.15 PHP Object Injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}