{"id":"CVE-2026-62016","kind":"vulnerability","aliases":["CVE-2026-62016"],"related":[],"title":"Gamic WordPress theme: unauthenticated PHP object injection lets attackers run code","description":"Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.","summary":"Gamic versions 1.19 and earlier contain an unauthenticated PHP object injection flaw. An attacker who sends a crafted request can inject a PHP object that may lead to code execution on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Gamic - Gaming Metaverse Game & Crypto WordPress Theme (ThemeREX)","fixed":[],"affected":"<= 1.19","ecosystem":"wordpress-theme"}],"ecosystems":[],"tags":["gamic","package","php","php-object-injection","themerex","wordpress","wordpress-theme"],"not_affected_if":["gamic-not-installed"],"how_to_check":"- WordPress admin > Appearance > Themes: look for 'Gamic - Gaming Metaverse Game & Crypto' (active or inactive) and its version; or read 'Version:' in wp-content/themes/gamic/style.css\n- Version 1.19 or lower is vulnerable; inactive installed themes can still be reachable, so delete it if unused\n- WP-CLI: wp theme list","fix":null,"status":"open","published_at":"2026-10-29T16:18:14+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","triaged_at":"2026-10-29T16:27:16+00:00","updated_at":"2026-10-29T16:28:13+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-29T16:27:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Gamic WordPress theme: unauthenticated PHP object injection lets attackers run code","impact":"high","summary":"Gamic versions 1.19 and earlier contain an unauthenticated PHP object injection flaw. An attacker who sends a crafted request can inject a PHP object that may lead to code execution on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["gamic","php","wordpress"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"code runs on the server; site data readable","analyst_note":"Confirm the product type, the vulnerable code path and whether a fixed version exists at https://nvd.nist.gov/vuln/detail/CVE-2026-62016.","how_to_check":"- Check the installed Gamic version in the theme settings or `style.css` header\n- Confirm whether the site runs Gamic at all; unknown whether it is a theme or plugin from the sources","plain_action":"","needs_analyst":true,"not_affected_if":["gamic-not-installed"],"who_is_affected":"Sites running Gamic version 1.19 or earlier are described as affected by the sources, with a CVSS score of 9.8. The sources do not describe the data path or configuration needed to reach the flaw, and unknown whether default settings are enough. Teams not running Gamic can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000666,"input_tokens":4047,"output_tokens":522,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the product type, the vulnerable code path and whether a fixed version exists at https://nvd.nist.gov/vuln/detail/CVE-2026-62016.","search":"'-2026':13A,16A '-62016':14A,17A '1.19':40B,77C 'attack':9A,51B 'code':11A,66B 'contain':43B 'craft':55B 'crypto':22A 'cve':12A,15A 'earlier':42B 'execut':67B 'flaw':49B 'game':21A 'gamic':1A,18A,26B,38B,76C 'gaming':19A 'inject':7A,32B,48B,58B,74C 'lead':64B 'let':8A 'may':63B 'metaverse':20A 'object':6A,31B,47B,61B,73C 'packag':27B 'php':5A,28B,30B,46B,60B,72C 'php-object-inject':29B 'request':56B 'run':10A 'send':53B 'server':70B 'theme':3A,24A,37B 'themerex':25A,33B 'unauthent':4A,45B,71C 'version':39B,78C 'wordpress':2A,23A,34B,36B 'wordpress-them':35B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the Gamic theme (ThemeREX) version 1.19 or earlier installed. The theme deserializes untrusted input and needs no login. Exploitation to code execution needs a usable POP chain from another installed plugin or theme, per WPScan; none is known in Gamic itself. Sites without Gamic can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62016","severity":null,"published_at":"2026-10-29T16:18:14+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","fetched_at":"2026-10-29T16:26:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-62016:1040","url":null,"severity":null,"published_at":"2026-10-29T16:28:13+00:00","modified_at":"2026-10-29T16:28:13+00:00","first_seen_at":"2026-10-29T16:28:13+00:00","fetched_at":"2026-10-29T16:28:13+00:00","note":"Theme (not plugin), <=1.19, unauth PHP object injection CWE-502; Patchstack/WPScan say no official patch, no known POP chain in Gamic itself (RCE depends on other plugins/themes). Not exploited per sources. CVSS 9.8 (Patchstack) vs 8.1 (Wordfence/WPScan). A securityonline page lists 'patched 1.19', which contradicts these and looks wrong. No vendor (ThemeREX) page found, so nothing marked verified; fix none rests on Patchstack/WPScan. Mitigation: Patchstack virtual patch rule only; otherwise remove/replace the theme."}],"documents":[{"id":17721,"url":"https://patchstack.com/database/wordpress/theme/gamic/vulnerability/wordpress-gamic-theme-1-19-php-object-injection-vulnerability","title":"Patchstack: WordPress Gamic Theme <= 1.19 PHP Object Injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":17722,"url":"https://wpscan.com/vulnerability/ce7a0c53-26f7-418d-995e-96228dde0992/","title":"WPScan: Gamic <= 1.19 Unauthenticated PHP Object Injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}