External risk intelligence

Coinpress PHP Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-62012

The vulnerability affects a WordPress theme, which by nature serves public-facing web content. As a web application component, it is commonly deployed in environments where it is directly reachable via the public internet to deliver site content and features to users.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Coinpress software, specifically related to PHP Object Injection, which could allow unauthenticated attackers to execute arbitrary code. This type of vulnerability impacts the integrity and confidentiality of systems processing serialized data. The main concern is confirming relevance and exposure within our environment.

Unauthenticated code execution vulnerability.
Affects software handling serialized data.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to a website using the affected theme. Because the vulnerability does not require authentication or user interaction, and can be reached over the network, an attacker could potentially inject malicious PHP objects, leading to severe consequences.

No authentication or user interaction needed.
Triggered by a network request to the theme.
Allows remote code execution and data compromise.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated attackers could exploit this vulnerability to inject malicious PHP objects into the application. This could lead to the execution of arbitrary code on the server, potentially resulting in the compromise of system data and sensitive information.

System data could be affected.
Unsanitized input can lead to exploitation.
Data theft or code execution may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

PHP Object Injection vulnerabilities in unauthenticated WordPress themes like Coinpress typically fall under the responsibility of platform or application teams managing the Content Management System (CMS). The first critical step is to identify all instances of the affected theme, determine their exposure to external networks, and assess their business criticality to prioritize remediation efforts. This involves coordinating with the application owner to plan a phased rollout or immediate action based on risk.

Platform and application teams own this issue.
Verify exposure and business criticality of affected instances.
Plan remediation, coordinating with application owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Coinpress software?

Coinpress is a theme designed for WordPress, the widely used content management system. Themes like this define the visual style and layout of a website. When installed, they run on the server to process requests and display content to site visitors, making them an integral part of the software stack that powers a website's frontend and functionality.

What does CVE-2026-62012 mean by PHP Object Injection?

This vulnerability, classified as CWE-502 (Deserialization of Untrusted Data), occurs when the application improperly processes serialized PHP data. Because the theme does not securely validate this input, an attacker can supply malicious PHP objects. When the server automatically reconstructs these objects, it may inadvertently execute unintended code or perform unauthorized actions on the host system.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted network request to a website using the vulnerable Coinpress theme. Because the weakness exists in how the theme handles input, it does not require the attacker to have an account or be logged in. Note that simply browsing the site normally or viewing public pages does not trigger this issue; the attacker must intentionally send malicious, malformed data.

Is my site at risk?

According to Halo Surface Signal, this vulnerability is considered likely to be reachable because WordPress themes are inherently designed to be accessed over the public internet. If your WordPress site uses an affected version of Coinpress and is reachable by external network traffic, it is effectively exposed to potential attempts to trigger this injection flaw.

What should I do if I use Coinpress?

Start by identifying every WordPress instance where Coinpress is currently installed. Work with your application or platform teams to confirm which sites are exposed to the internet versus those kept on internal networks. Once you have an inventory, prioritize updates for the most critical or public-facing sites first, coordinating closely with site owners to manage the deployment of any available security patches.

References

patchstack.com/database/wordpress/theme/coinpress/vulnerability/word…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.