Critical Unauthenticated PHP Object Injection Found in Stargaze WordPress Theme
The National Vulnerability Database lists CVE-2026-62051 as a critical flaw in Stargaze versions up to 1.10, allowing remote code execution.
Key points
- CVE-2026-62051 carries a CVSS score of 9.8, classified as critical severity.
- The vulnerability affects ThemeREX Stargaze WordPress theme versions 1.10 and earlier.
- Attackers can exploit the flaw without authentication via PHP object injection.
The National Vulnerability Database has published a record for CVE-2026-62051, identifying a critical security vulnerability in the Stargaze WordPress theme. This flaw allows unauthenticated attackers to inject PHP objects into the application, potentially leading to remote code execution on affected servers.
At a glance
- CVE
- CVE-2026-62051
- Product
- ThemeREX Stargaze
- CVSS
- 9.8 Critical
- Weakness
- insecure deserialization
- Exploited
- No known exploitation
The vulnerability is rated 9.8 on the Common Vulnerability Scoring System, which places it in the critical severity range. According to the NVD record, the issue stems from CWE-502, which describes insecure deserialization or object injection weaknesses. This high score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability.
Context and Background
PHP object injection occurs when an application deserializes untrusted data without proper validation. In this specific case, the Stargaze theme fails to adequately sanitize input before processing it as a PHP object. This allows an attacker to manipulate the object structure, forcing the server to execute arbitrary commands.
The weakness is categorized under CWE-502 by the Common Weakness Enumeration. This category highlights risks where applications deserialize objects from untrusted sources. Such flaws are particularly dangerous because they often bypass standard authentication checks, granting attackers immediate access to the underlying system.
Who Is Affected
The vulnerability impacts users of the Stargaze WordPress theme developed by ThemeREX. Specifically, all versions up to and including 1.10 are susceptible to this attack. Any website running these older versions is exposed to potential compromise if the vulnerable endpoints are accessible from the internet.
ThemeREX is the vendor responsible for the Stargaze theme. Users who have not updated their installations since version 1.10 remain at risk. The NVD record explicitly lists "ThemeREX Stargaze up to 1.10" as the affected software component.
What should you do?
Security teams should immediately audit their WordPress installations for the presence of the Stargaze theme. Identifying the specific version number is crucial to determining exposure. If version 1.10 or lower is detected, the site is vulnerable to unauthenticated exploitation.
Administrators should check server logs for unusual activity that might indicate an attempted object injection attack. Monitoring for unexpected file changes or new user accounts can help detect successful exploitation. Immediate action is required to mitigate the risk of remote code execution.
Background: Insecure deserialization
Look for base64-encoded parameters, unexpected object instantiation, or state changes that bypass authentication. Inspect input handling for unvalidated deserialization. Use allowlists for expected data types and verify integrity with digital signatures to prevent arbitrary code execution.
Read the full guide: Warning Signs of Insecure Deserialization in Web Applications
What to do and how to stay safe: CVE-2026-62051
- Scan your WordPress installation to identify if the Stargaze theme is present and check its version number against the affected list.
- Review web server access logs for suspicious requests targeting endpoints that handle serialized data or object deserialization.
- Implement a Web Application Firewall rule to block requests containing PHP serialization patterns if you cannot immediately update the theme.
- Monitor system integrity by checking for unexpected file modifications or new administrative accounts that may indicate a successful breach.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-62051?
The National Vulnerability Database assigns a CVSS score of 9.8 to this vulnerability, classifying it as critical.
Which versions of the Stargaze theme are affected?
All versions of the ThemeREX Stargaze WordPress theme up to and including version 1.10 are affected by this flaw.
Does this vulnerability require authentication to exploit?
No, the NVD record describes the flaw as an unauthenticated PHP object injection, meaning no login is required.
