Critical Unauthenticated PHP Object Injection Found in Splendour WordPress Theme

The National Vulnerability Database (NVD) has published details on CVE-2026-62050, a critical security vulnerability affecting the Splendour WordPress theme. This flaw allows attackers to perform unauthenticated PHP object injection, potentially leading to remote code execution on affected websites. The vulnerability impacts all versions of the theme up to and including version 1.23, released by vendor ThemeREX.

The NVD assigns a CVSS score of 9.8 to this vulnerability, classifying it as Critical. This high severity rating reflects the ease with which an attacker can exploit the flaw without needing prior authentication or credentials. The weakness is categorized under CWE-502, which relates to improper restriction of XML external entity references or related injection vulnerabilities that can compromise system integrity.

Context and Background

PHP object injection is a serious class of vulnerability that occurs when an application deserializes untrusted data. Attackers can craft serialized data containing malicious objects, which are then instantiated by the application. This can lead to arbitrary code execution, data theft, or complete server compromise. The NVD record explicitly identifies the injection as unauthenticated, meaning remote attackers can trigger the exploit from any location without needing access to the WordPress admin panel.

ThemeREX is a known developer of WordPress themes and templates. The Splendour theme is one of their products, designed for various website types. By affecting versions up to 1.23, the vulnerability covers a significant portion of the user base that has not updated to a hypothetical patched version. The lack of authentication requirements makes this threat particularly dangerous for publicly accessible websites.

Who Is Affected

Any WordPress site running the Splendour theme by ThemeREX in version 1.23 or earlier is vulnerable to CVE-2026-62050. Website administrators must check their current theme version immediately to determine exposure. The vulnerability is specific to the Splendour theme and does not inherently affect other WordPress themes or plugins unless they share the same vulnerable codebase. Users of newer versions, if available, may not be affected, but no confirmed patch has been cited in the source material.

Administrators should verify their theme version through the WordPress dashboard or by checking the theme files directly. If the installed version is 1.23 or lower, the site is at risk. The widespread use of WordPress themes means that many small businesses and personal blogs could be exposed if they have not kept their software updated.

What should you do?

Security professionals and site administrators should prioritize identifying all instances of the Splendour theme on their managed infrastructure. Immediate verification of the installed version is necessary to assess risk. If the vulnerable version is detected, isolating the server or restricting access may be prudent until a mitigation strategy is determined. Monitoring server logs for unusual PHP execution patterns can help detect potential exploitation attempts.