{"id":"CVE-2026-62018","kind":"vulnerability","aliases":["CVE-2026-62018"],"related":[],"title":"Gunslinger: unauthenticated PHP object injection in versions 1.11 and earlier","description":"Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.","summary":"Gunslinger, a WordPress theme, has an unauthenticated PHP object injection (unsafe deserialization of untrusted input) in all versions up to and including 1.11. Patchstack reports no official patch. The theme has no known gadget chain of its own, so real impact depends on other installed plugins or themes, and can reach code execution if one exists.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Gunslinger","fixed":[],"affected":"<= 1.11","ecosystem":"wordpress-theme"}],"ecosystems":[],"tags":["gunslinger","other","php","php-object-injection","wordpress","wordpress-theme"],"not_affected_if":["fixed-version","managed-hosting","not-installed"],"how_to_check":"In WordPress admin go to Appearance > Themes and check the Gunslinger version, or read the Version line in wp-content/themes/gunslinger/style.css. 1.11 or lower is affected. Installed but inactive themes count, so remove it if unused.","fix":"No fixed version as of 2026-10-29 (Patchstack: no official patch). Switch to another theme and delete Gunslinger, or ask the vendor for a patch. Patchstack offers a mitigation rule to its customers.","status":"open","published_at":"2026-10-29T16:18:14+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","triaged_at":"2026-10-29T16:27:22+00:00","updated_at":"2026-10-29T16:28:29+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-10-29T16:27:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Gunslinger: unauthenticated PHP object injection in versions 1.11 and earlier","impact":"high","summary":"Gunslinger versions up to 1.11 let an unauthenticated remote user inject serialized PHP objects. The sources do not describe the exact code path or the full extent of what an attacker can reach.","audience":"businesses","category":"other","nicknames":[],"who_cares":["php","gunslinger"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker injects PHP objects; possible code execution on server","analyst_note":"Find the vendor's fixed version and the product type (plugin, library or app) from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-62018.","how_to_check":"- Check the installed Gunslinger version and compare it with 1.11, which NVD lists as the last affected version.\n- Any installed version at or below `1.11` is in scope.","plain_action":"","needs_analyst":true,"not_affected_if":["not-installed","fixed-version"],"who_is_affected":"Sites or systems running Gunslinger version 1.11 or earlier are in scope according to NVD. The sources do not say which data path or configuration makes the flaw reachable, so teams that do not run Gunslinger can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00122,"input_tokens":4051,"output_tokens":1629,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor's fixed version and the product type (plugin, library or app) from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-62018.","search":"'-2026':12A,15A '-62018':13A,16A '1.11':8A,51B,91C 'chain':63B 'code':80B 'cve':11A,14A 'depend':70B 'deseri':40B 'earlier':10A 'execut':81B 'exist':84B 'gadget':62B 'gunsling':1A,18B,29B,90C 'gunslinger':17A 'impact':69B 'includ':50B 'inject':5A,24B,38B,88C 'input':43B 'instal':73B 'known':61B 'object':4A,23B,37B,87C 'offici':55B 'one':83B 'patch':56B 'patchstack':52B 'php':3A,20B,22B,36B,86C 'php-object-inject':21B 'plugin':74B 'reach':79B 'real':68B 'report':53B 'theme':28B,32B,58B,76B 'unauthent':2A,35B,85C 'unsaf':39B 'untrust':42B 'version':7A,46B,92C 'wordpress':25B,27B,31B 'wordpress-them':26B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the Gunslinger theme at version 1.11 or earlier, active or merely installed, are exposed to unauthenticated attackers. Impact depends on whether another plugin or theme on the site supplies a usable gadget chain. Sites that do not use Gunslinger can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62018","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62018","severity":null,"published_at":"2026-10-29T16:18:14+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","fetched_at":"2026-10-29T16:26:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-62018:1039","url":null,"severity":null,"published_at":"2026-10-29T16:28:29+00:00","modified_at":"2026-10-29T16:28:29+00:00","first_seen_at":"2026-10-29T16:28:29+00:00","fetched_at":"2026-10-29T16:28:29+00:00","note":"Gunslinger is a ThemeRex WordPress theme; Patchstack (CNA) lists <=1.11 unpatched, no official patch. No known POP chain in the theme itself; impact depends on other plugins/themes. Patchstack is the CNA database, not the vendor, so nothing marked verified. Nothing exploited or PoC found."}],"documents":[{"id":17724,"url":"https://patchstack.com/database/wordpress/theme/gunslinger/vulnerability/wordpress-gunslinger-theme-1-11-php-object-injection-vulnerability","title":"Patchstack: WordPress Gunslinger Theme <= 1.11 PHP Object Injection (no official patch)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":17725,"url":"https://wordsec.net/vulnerabilities/themes/gunslinger/gunslinger-111-unauthenticated-php-object-injection","title":"WordSec: Gunslinger <= 1.11 Unauthenticated PHP Object Injection","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}