Live › vulnerability › CVE-2026-62016
Gamic versions 1.19 and earlier contain an unauthenticated PHP object injection flaw. An attacker who sends a crafted request can inject a PHP object that may lead to code execution on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
WordPress sites with the Gamic theme (ThemeREX) version 1.19 or earlier installed. The theme deserializes untrusted input and needs no login. Exploitation to code execution needs a usable POP chain from another installed plugin or theme, per WPScan; none is known in Gamic itself. Sites without Gamic can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Gamic - Gaming Metaverse Game & Crypto WordPress Theme (ThemeREX) | wordpress-theme | <= 1.19 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-62016")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.