{"id":"CVE-2026-62123","published":"2026-10-10T20:16:44Z","modified":"2026-10-13T13:28:15Z","title":"Unauthenticated PHP Object Injection in Invetex <= 2.18 versions","vendor":"ThemeREX","product":"Invetex","tier":"core","eol":null,"description":{"text":"Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an unauthenticated PHP object injection (insecure deserialization of untrusted data) in the Invetex product from ThemeREX, affecting versions up to and including 2.18. Based on the attack vector, an attacker needs only network access to the affected component, with no privileges, no user interaction, and no special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:20:43Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00304,"percentile":0.23245,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/invetex/vulnerability/wordpress-invetex-theme-2-18-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-96508","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-96508","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62123","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":11.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":4.65,"detail":"percentile 0.2324"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}