---
id: "CVE-2026-62012"
kind: "vulnerability"
aliases: ["CVE-2026-62012"]
title: "Coinpress: unauthenticated PHP object injection lets attackers run code"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Coinpress", "fixed": [], "affected": "<= 1.0.15", "ecosystem": "wordpress-theme"}]
ecosystems: []
tags: ["coinpress", "package", "php", "theme", "themerex", "wordpress"]
not_affected_if: ["plugin-not-installed", "theme-not-installed"]
published_at: "2026-10-29T16:18:13+00:00"
first_seen_at: "2026-10-29T16:26:00+00:00"
updated_at: "2026-10-29T16:28:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62012", "first_seen_at": "2026-10-29T16:26:00+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T16:28:13+00:00"}]
---

# Coinpress: unauthenticated PHP object injection lets attackers run code

The Coinpress WordPress theme (ThemeREX) versions 1.0.15 and earlier deserialize untrusted PHP data without authentication. An attacker can use this PHP object injection to run code or take over the site. No patched version exists yet.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-theme:Coinpress affected <= 1.0.15 fixed ?

## How to check

In WordPress admin go to Appearance > Themes and check whether the Coinpress theme (ThemeREX) is installed, even if inactive, and its version; or read the Version line in wp-content/themes/coinpress/style.css. 1.0.15 or lower is affected.

## Fix

No patched version available per Patchstack. Remove or replace the Coinpress theme until ThemeREX ships a fix.

## Timeline

- 2026-10-29T16:26:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62012
- 2026-10-29T16:28:13+00:00 analyst — Patchstack (CNA) lists Coinpress as a ThemeREX WordPress THEME, not a plugin, <=1.0.15, no official patch as of 2026-10-29; Patchstack mitigation rule exists for its customers. Endpoint not disclosed. No exploitation or PoC seen; not searched X.

## Documents

- [advisory] Patchstack: WordPress Coinpress Theme <= 1.0.15 PHP Object Injection https://patchstack.com/database/wordpress/theme/coinpress/vulnerability/wordpress-coinpress-theme-1-0-15-php-object-injection-vulnerability

## From the sources

Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_