{"id":"CVE-2026-62015","kind":"vulnerability","aliases":["CVE-2026-62015"],"related":[],"title":"Gamezone WordPress theme: unauthenticated PHP object injection lets attackers run code","description":"Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.","summary":"Gamezone versions 1.1.11 and earlier accept untrusted serialized PHP data, which lets an unauthenticated visitor inject PHP objects. A successful attacker can often turn that into code execution on the server, though the sources do not detail the exact gadget chain.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gamezone-theme","package","self-hosted","wordpress"],"not_affected_if":["theme-not-installed","theme-updated"],"how_to_check":"- Check the installed Gamezone version in the theme's style.css header or the Appearance > Themes screen, and compare it with `1.1.11`","fix":"- Gamezone versions after `1.1.11` (exact fixed version not stated in the sources)","status":"open","published_at":"2026-10-29T16:18:14+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","triaged_at":"2026-10-29T16:27:19+00:00","updated_at":"2026-10-29T16:27:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:27:19Z","model":"claude-haiku-5-5","output":{"fix":"- Gamezone versions after `1.1.11` (exact fixed version not stated in the sources)\n- unknown","reach":"internet","title":"Gamezone WordPress theme: unauthenticated PHP object injection lets attackers run code","impact":"high","summary":"Gamezone versions 1.1.11 and earlier accept untrusted serialized PHP data, which lets an unauthenticated visitor inject PHP objects. A successful attacker can often turn that into code execution on the server, though the sources do not detail the exact gadget chain.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","gamezone-theme","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker may run code on the server unauthenticated","analyst_note":"Confirm the fixed version and exploitability details from the NVD entry and the theme vendor's changelog; the sources give only the NVD description.","how_to_check":"- Check the installed Gamezone version in the theme's style.css header or the Appearance > Themes screen, and compare it with `1.1.11`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["theme-not-installed","theme-updated"],"who_is_affected":"Sites running the Gamezone theme at version 1.1.11 or earlier are exposed, and no account is needed according to the NVD description. Sites that do not use this theme are not affected. The sources do not say whether specific plugins or settings are required to reach the flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00069,"input_tokens":4053,"output_tokens":570,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-62015':14A,17A '1.1.11':28B,73C 'accept':31B 'attack':9A,46B 'chain':66B 'code':11A,52B 'cve':12A,15A 'data':35B 'detail':62B 'earlier':30B 'exact':64B 'execut':53B 'gadget':65B 'gamezon':1A,19B,26B,72C 'gamezone-them':18B 'host':24B 'inject':7A,41B,70C 'let':8A,37B 'object':6A,43B,69C 'often':48B 'packag':21B 'php':5A,34B,42B,68C 'run':10A 'self':23B 'self-host':22B 'serial':33B 'server':56B 'sourc':59B 'success':45B 'theme':3A,20B 'though':57B 'turn':49B 'unauthent':4A,39B,67C 'untrust':32B 'version':27B,74C 'visitor':40B 'wordpress':2A,25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Gamezone theme at version 1.1.11 or earlier are exposed, and no account is needed according to the NVD description. Sites that do not use this theme are not affected. The sources do not say whether specific plugins or settings are required to reach the flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62015","severity":null,"published_at":"2026-10-29T16:18:14+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","fetched_at":"2026-10-29T16:26:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}