Loading vulnerability…
PHP Object Injection in ThemeREX Booklovers
CVE-2026-62045 is an untrusted-data deserialization vulnerability in the ThemeREX Group Booklovers WordPress theme. Deserialization of untrusted input allows PHP object injection. Affected versions extend through 2.13.0; the earliest affected version and vulnerable function are unspecified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows object injection through deserialization of untrusted data. Specific consequences beyond object injection, including code execution, data disclosure, or service disruption, are not established.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.