Live › vulnerability › CVE-2026-62018
Gunslinger, a WordPress theme, has an unauthenticated PHP object injection (unsafe deserialization of untrusted input) in all versions up to and including 1.11. Patchstack reports no official patch. The theme has no known gadget chain of its own, so real impact depends on other installed plugins or themes, and can reach code execution if one exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
WordPress sites with the Gunslinger theme at version 1.11 or earlier, active or merely installed, are exposed to unauthenticated attackers. Impact depends on whether another plugin or theme on the site supplies a usable gadget chain. Sites that do not use Gunslinger can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Gunslinger | wordpress-theme | <= 1.11 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-62018")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.