External risk intelligence

Marcell Theme Unauthenticated PHP Object Injection.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-62001

The vulnerability exists in a WordPress theme, which is by definition a web-facing application component. WordPress themes are commonly deployed on public-facing web servers to deliver content, making them inherently accessible to internet traffic.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Marcell theme for WordPress, potentially allowing unauthorized access and data manipulation. While the direct business impact remains to be assessed, this type of flaw could expose systems to significant compromise if present.

Unauthenticated PHP injection flaw found.
Could allow unauthorized system access.
Confirm relevance and system exposure.

Attack Path

How an attacker could exploit the issue

An attacker can leverage an unauthenticated PHP Object Injection vulnerability in the Marcell theme to execute arbitrary code on the server. This occurs when specially crafted input is processed, allowing the injection of malicious PHP objects. Successful exploitation could lead to complete compromise of the affected website and its underlying infrastructure.

Requires no authentication.
Triggered by submitting crafted user input.
Enables remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject PHP objects into the system, potentially leading to a compromise of the application's integrity and availability when supported by the advisory.

System data may be affected.
Malicious code could be executed.
Service disruption could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The unauthenticated PHP Object Injection in Marcell presents a critical risk, primarily impacting application owners and platform teams responsible for managing WordPress themes. The initial practical step is to identify all instances of the Marcell theme, assess their exposure and business criticality, and pinpoint the accountable system owners. Following this, a prioritized remediation plan, potentially involving vendor coordination or temporary risk reduction, should be executed.

Application owners should manage remediation.
Verify theme installation and exposure.
Plan and coordinate risk-based fixes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Marcell theme?

Marcell is a WordPress theme designed to control the visual layout, styling, and front-end user experience of websites built on the WordPress content management system. As a theme component, it integrates directly with the site's PHP environment to render pages and handle interactive elements, making it an essential part of the server-side presentation layer.

What does PHP Object Injection mean for CVE-2026-62001?

This vulnerability is classified as CWE-502, Deserialization of Untrusted Data. It occurs when the theme processes serialized PHP objects from user input without proper validation. Because the application blindly trusts this data, an attacker can manipulate the object structure to execute unintended code, potentially gaining full control over the web server's operations.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted input to the application that the Marcell theme processes. Because it is an unauthenticated vulnerability, no login or administrative permissions are required to initiate the attack. However, the flaw is only triggered if the application actively processes the malicious payload; simply visiting the site or viewing static content does not inherently trigger the object injection.

Is my site relevant if it uses the Marcell theme?

Yes. According to Halo Surface Signal, WordPress themes are web-facing application components designed to be accessible to internet traffic. Since this vulnerability allows unauthenticated access, any server running an affected version of Marcell that is reachable from the public internet is considered a high-priority target for external actors.

Do I need to update my WordPress installation immediately?

Your first step is to perform an audit to verify where the Marcell theme is installed across your environment. Once identified, document which instances are internet-facing and determine the business criticality of those sites. Prioritize these assets for remediation, which may involve coordinating with the vendor for updates or implementing temporary controls to limit access until a permanent fix is applied.

References

patchstack.com/database/wordpress/theme/marcell/vulnerability/wordpr…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.