CVE-2026-62001: WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

The vulnerability is unauthenticated and remotely exploitable, so an attacker does not need a WordPress account or prior privileges.

The reported severity vector indicates high potential impact to confidentiality, integrity, and availability. The scope is unchanged.

Marcell theme versions through 1.2.14 are affected. The provided data does not identify a fixed version.

Published Oct 29, 2026

Updated

Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Marcell theme to a version that resolves this vulnerability.
Fixed in 1.2.14

Oct 29, 2026

CVE Published

via MITRE·03:24 PM

Data Sourced