{"id":"CVE-2026-62086","published":"2026-10-10T20:16:42Z","modified":"2026-10-13T13:28:15Z","title":"Unauthenticated PHP Object Injection in Juno <= 2.25 versions","vendor":"ThemeREX","product":"Juno","tier":"core","eol":null,"description":{"text":"Unauthenticated PHP Object Injection in Juno <= 2.25 versions.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a PHP object injection (insecure deserialization of untrusted data) in ThemeREX's Juno WordPress theme, affecting versions 2.25 and earlier. An unauthenticated remote attacker can exploit it over the network without user interaction or prior authentication, by supplying crafted serialized input that the affected Juno component deserializes.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:19:36Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00375,"percentile":0.31505,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/junotoys/vulnerability/wordpress-juno-theme-2-25-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-96491","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-96491","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62086","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":13.2,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":6.3,"detail":"percentile 0.3150"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}