External risk intelligence

Good Homes Theme Unauthenticated PHP Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-62017

This vulnerability affects a WordPress theme. WordPress themes are publicly accessible web components that render content to end users. Because the theme is part of a web application deployed to serve web traffic, the attack surface is commonly exposed to the public internet.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in the Good Homes platform, specifically related to PHP Object Injection. This type of flaw can allow unauthorized access and manipulation of the system if exploited, potentially impacting the integrity and availability of services. The primary concern is confirming if this specific platform is in use and assessing any associated exposure.

Allows code injection via unauthenticated access.
Matters due to critical severity and widespread technology.
Confirm relevance and exposure for business systems.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to a vulnerable installation of the Good Homes theme. This could allow them to inject malicious PHP code, potentially leading to full compromise of the affected website.

No authentication needed to attack.
Triggered by sending a malicious request.
Leads to website compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject PHP objects into the system when supported by the advisory. This may lead to unauthorized code execution or manipulation of application behavior when the vulnerable application unserializes untrusted data.

Sensitive system data could be affected.
Unauthenticated remote code injection.
Compromise of application integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that this is an unauthenticated PHP Object Injection vulnerability in a WordPress theme, responsibility likely falls to the team managing the WordPress instances and the associated theme(s). The first step is to identify all WordPress deployments running the affected theme, confirm their exposure (especially internet-facing ones), and determine the business criticality of each instance to prioritize remediation efforts.

Identify WordPress theme owner.
Verify affected theme installations and exposure.
Plan remediation or mitigation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Good Homes theme?

Good Homes is a WordPress theme, which acts as a design and functional template for websites built on the WordPress content management system. These themes control the visual layout and user interface elements, and are typically installed to manage how content is rendered to visitors on a web server.

What does PHP Object Injection mean for CVE-2026-62017?

This vulnerability is classified as CWE-502, which occurs when an application unserializes untrusted data without proper validation. In this CVE, an attacker sends malicious input that the application mistakenly interprets as a valid PHP object. This weakness can trick the system into executing unintended code or manipulating application behavior.

How is this vulnerability triggered?

An attacker triggers the flaw by sending a specially crafted, malicious request to a website running the affected theme. No user account or password is required to initiate this process. If the system were configured to strictly reject all incoming data requests or lacked the specific unserialization routines affected by this bug, the attack would not be successful.

Why should I care if my site is internet-facing?

Halo Surface Signal indicates that because this is a WordPress theme, it is inherently designed to render web traffic and is likely exposed to the public internet. Since no authentication is required to trigger the issue, any site using an affected version of Good Homes is directly reachable by unauthorized remote parties.

Do I need to take action if I use Good Homes?

Yes. Start by creating an inventory of all WordPress deployments in your environment to identify where the Good Homes theme is active. Once you have a list of affected installations, confirm which instances are accessible to the public and prioritize them for remediation based on their business importance.

References

patchstack.com/database/wordpress/theme/good-homes/vulnerability/wor…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.