CVE-2026-62012: WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability
Published Oct 29, 2026
·Updated
Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.
Event History
Oct 29, 2026
CVE Published
via MITRE·03:24 PM
Data Sourced
via MITRE·03:24 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is unauthenticated and remotely reachable. An attacker does not need WordPress credentials or user interaction to attempt exploitation.
2
Which installations are affected?
Coinpress theme versions 1.0.15 and earlier are affected. The provided information does not identify any configuration prerequisite, so affected versions should be treated as exposed until updated or otherwise mitigated.
3
What is the potential impact?
The vulnerability is rated critical with a 9.8 CVSS score and can affect confidentiality, integrity, and availability at high impact. Successful PHP object injection may allow an attacker to leverage available PHP object behavior on the site.