External risk intelligence

Edge Decor Theme Unauthenticated PHP Object Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-62013

This vulnerability affects a WordPress theme, which is a component of a web application. WordPress sites are frequently deployed as public-facing web applications, making them typically reachable from the internet.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security issue has been identified in Edge Decor, a WordPress theme, which could allow attackers to remotely inject malicious code into affected systems without needing authentication. This type of vulnerability, known as PHP Object Injection, can potentially lead to a complete compromise of the web application. The main concern at this stage is to confirm if your organization utilizes this specific theme and assess any potential exposure.

Unauthenticated code injection in a WordPress theme.
Could allow attackers to take over websites.
Confirm use and assess relevance for your organization.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data over the network to a web application using the vulnerable component. This could allow them to inject malicious code, potentially leading to a complete compromise of the affected system.

Requires no authentication.
PHP object injection in the vulnerable component.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated PHP Object Injection in Edge Decor could allow an unauthenticated attacker to execute arbitrary code on the server when supported by the advisory. This could impact the integrity and availability of the affected system.

System code and data.
Via a crafted PHP object.
Potential for complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Edge Decor themes impacts unauthenticated PHP object injection, requiring immediate attention. The primary responsibility for addressing this issue likely falls to application owners and platform teams who manage WordPress deployments. The first practical step involves identifying all instances of the affected theme, assessing their exposure and business criticality, and confirming the accountable owner to initiate a coordinated remediation plan.

Application owners should prioritize this issue.
Verify theme deployment and external reachability first.
Plan for vendor coordination and timely remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Edge Decor?

Edge Decor is a theme used within the WordPress content management system. Themes in WordPress dictate the visual design and layout of a website. When a theme includes custom code for its features, it becomes part of the application's underlying logic, which can introduce security risks if that code handles data improperly.

What is a PHP Object Injection vulnerability?

This vulnerability falls under the CWE-502 weakness class. It occurs when an application accepts untrusted data and uses it to recreate a PHP object without sufficient validation. Because PHP objects can contain specific instructions and properties, an attacker can manipulate this process to inject their own malicious logic, often resulting in unauthorized code execution on the server hosting the site.

How does an attacker trigger CVE-2026-62013?

An attacker triggers this flaw by sending a specially prepared data payload to the web application over the network. Because the vulnerability does not require any user credentials or login status to function, the application processes the malicious input automatically. Simply browsing the site normally or performing standard administrative actions does not trigger the bug; it requires the specific, crafted malicious data.

Do I need to worry about this if my site is not public?

Halo Surface Signal indicates that because this is a WordPress theme, it is most often used in public-facing web applications. If your instance of Edge Decor is accessible from the internet, it is inherently more reachable for exploitation. If the site is hosted strictly on an internal, private network, the immediate threat is lower, though the vulnerability remains present within the application's code.

How should I respond to this threat?

Your first step is to perform an inventory of your WordPress environments to confirm if Edge Decor is installed and active. Once identified, evaluate the role of these sites to determine their business criticality. Coordinate with your platform or application management teams to monitor for vendor-provided updates or official guidance on replacing or securing the theme configuration.

References

patchstack.com/database/wordpress/theme/edge-decor/vulnerability/wor…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.