---
id: "CVE-2026-62018"
kind: "vulnerability"
aliases: ["CVE-2026-62018"]
title: "Gunslinger: unauthenticated PHP object injection in versions 1.11 and earlier"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Gunslinger", "fixed": [], "affected": "<= 1.11", "ecosystem": "wordpress-theme"}]
ecosystems: []
tags: ["gunslinger", "other", "php", "php-object-injection", "wordpress", "wordpress-theme"]
not_affected_if: ["fixed-version", "managed-hosting", "not-installed"]
published_at: "2026-10-29T16:18:14+00:00"
first_seen_at: "2026-10-29T16:26:01+00:00"
updated_at: "2026-10-29T16:28:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62018", "first_seen_at": "2026-10-29T16:26:01+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T16:28:29+00:00"}]
---

# Gunslinger: unauthenticated PHP object injection in versions 1.11 and earlier

Gunslinger, a WordPress theme, has an unauthenticated PHP object injection (unsafe deserialization of untrusted input) in all versions up to and including 1.11. Patchstack reports no official patch. The theme has no known gadget chain of its own, so real impact depends on other installed plugins or themes, and can reach code execution if one exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-theme:Gunslinger affected <= 1.11 fixed ?

## How to check

In WordPress admin go to Appearance > Themes and check the Gunslinger version, or read the Version line in wp-content/themes/gunslinger/style.css. 1.11 or lower is affected. Installed but inactive themes count, so remove it if unused.

## Fix

No fixed version as of 2026-10-29 (Patchstack: no official patch). Switch to another theme and delete Gunslinger, or ask the vendor for a patch. Patchstack offers a mitigation rule to its customers.

## Timeline

- 2026-10-29T16:26:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62018
- 2026-10-29T16:28:29+00:00 analyst — Gunslinger is a ThemeRex WordPress theme; Patchstack (CNA) lists <=1.11 unpatched, no official patch. No known POP chain in the theme itself; impact depends on other plugins/themes. Patchstack is the CNA database, not the vendor, so nothing marked verified. Nothing exploited or PoC found.

## Documents

- [advisory] Patchstack: WordPress Gunslinger Theme <= 1.11 PHP Object Injection (no official patch) https://patchstack.com/database/wordpress/theme/gunslinger/vulnerability/wordpress-gunslinger-theme-1-11-php-object-injection-vulnerability
- [describes] WordSec: Gunslinger <= 1.11 Unauthenticated PHP Object Injection https://wordsec.net/vulnerabilities/themes/gunslinger/gunslinger-111-unauthenticated-php-object-injection

## From the sources

Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_