Critical Object Injection Flaw Found in Booklovers WordPress Theme

The National Vulnerability Database recorded a critical vulnerability in the Booklovers WordPress theme on Tuesday. The flaw, identified as CVE-2026-62045, allows attackers to inject objects through the deserialization of untrusted data within the software. This issue impacts all versions of the theme released by ThemeREX Group up to version 2.13.0.

The National Vulnerability Database assigns a CVSS score of 9.8 to CVE-2026-62045, classifying it as critical severity. The weakness is categorized under CWE-502, which covers the deserialization of untrusted data. Attackers can exploit this flaw to execute arbitrary code or perform other malicious actions by sending specially crafted serialized data to the application. No vendor patch or confirmed fix has been announced for this vulnerability at this time.

Context and Background

Deserialization vulnerabilities remain a persistent threat in web application security. When an application deserializes untrusted data without proper validation, it can lead to remote code execution. The National Vulnerability Database lists this specific issue under CWE-502, highlighting the inherent risks of processing serialized objects from external sources. Booklovers is a popular theme developed by ThemeREX Group, widely used for creating book-related websites and online stores.

The flaw exists in how the Booklovers theme handles data inputs. According to the NVD record, the vulnerability allows object injection, which can compromise the integrity of the web server hosting the theme. Security researchers emphasize that such flaws can be exploited automatically by scanning bots or targeted by human attackers seeking high-impact entry points. The critical rating reflects the ease of exploitation and the high impact on confidentiality, integrity, and availability.

Who Is Affected

The vulnerability affects all installations of the Booklovers theme by ThemeREX Group. According to the NVD record, the issue is present in versions from inception through 2.13.0. This means any site running the theme prior to the next potential release is exposed to risk. Users of older versions are not safe from this specific object injection flaw. ThemeREX Group has not yet provided a patched version that resolves CVE-2026-62045.

Site administrators using the Booklovers theme should verify their current version immediately. The NVD record specifies that versions up to 2.13.0 are affected. If a website is running any of these versions, it is vulnerable to the described object injection attack. The lack of a confirmed fix means that users must rely on mitigation strategies while waiting for an official update from the vendor. Exposure continues until a secure version is released and deployed.

What should you do?

Site owners should assess their current Booklovers theme version against the affected range. Since no patch exists, monitoring server logs for unusual activity is recommended. Administrators can consider restricting access to administrative interfaces or using web application firewalls to filter suspicious requests. Waiting for an official update from ThemeREX Group is the most reliable long-term solution.