CVE-2026-62008: WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability
Published Oct 29, 2026
·Updated
Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.
Event History
Oct 29, 2026
CVE Published
via MITRE·03:24 PM
Data Sourced
via MITRE·03:24 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior access to target an affected site.
2
Which installations are affected?
Sites using the Orpheus WordPress theme at version 1.8 or earlier are affected according to the available information.
3
What is the potential impact?
The supplied severity vector rates confidentiality, integrity, and availability impact as high. The issue is remotely exploitable with low attack complexity and requires no user interaction.