Live › vulnerability › CVE-2026-62015
Gamezone versions 1.1.11 and earlier accept untrusted serialized PHP data, which lets an unauthenticated visitor inject PHP objects. A successful attacker can often turn that into code execution on the server, though the sources do not detail the exact gadget chain.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Sites running the Gamezone theme at version 1.1.11 or earlier are exposed, and no account is needed according to the NVD description. Sites that do not use this theme are not affected. The sources do not say whether specific plugins or settings are required to reach the flaw.
No product ranges from the sources yet.
1.1.111.1.11 (exact fixed version not stated in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-62015")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.