CVE-2026-62013: WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability
Published Oct 29, 2026
·Updated
Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.
Event History
Oct 29, 2026
CVE Published
via MITRE·03:24 PM
Data Sourced
via MITRE·03:24 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or existing privileges to attempt exploitation.
2
Which installations are affected?
Edge Decor theme versions 2.9 and earlier are identified as affected.
3
How severe is the potential impact?
The supplied vector rates the issue as critical at 9.8, with network-based exploitation requiring low complexity, no privileges, and no user interaction. It can affect confidentiality, integrity, and availability at high impact.