External risk intelligence

ThemeREX Addons PHP Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-62105

The vulnerability exists in a WordPress plugin. WordPress sites and their associated plugins are commonly deployed as public-facing web applications, making them frequently accessible via the internet in standard real-world configurations.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the ThemeREX Addons software, specifically related to how it handles data inputs. This could allow unauthorized access to systems, potentially leading to significant compromise if exploited. The main concern at this stage is to confirm if our environment utilizes this specific software and to what extent.

Unauthenticated code injection flaw found.
Impacts web applications using the software.
Assess relevance and system exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted data to a website using the vulnerable ThemeREX Addons plugin. This allows them to inject malicious PHP objects, potentially leading to full control over the affected website.

No authentication is required.
Specially crafted data is sent to the plugin.
Risk of full website compromise.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated PHP Object Injection in ThemeREX Addons could allow an attacker to execute arbitrary code on the server, potentially leading to a full compromise of the affected website and its underlying systems. This could occur when the plugin processes unsanitized user input.

Server-side code execution.
Unauthenticated network access.
Complete website compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated PHP object injection vulnerability in ThemeREX Addons is likely to impact public-facing web applications. The first step is for infrastructure or platform teams to identify all instances of the affected plugin, determine their exposure and criticality, and then work with application owners to plan remediation.

Application and platform teams should own the issue.
Verify plugin instances and external reachability.
Plan coordinated updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ThemeREX Addons plugin?

ThemeREX Addons is a software component designed for the WordPress platform. It functions as a plugin that extends a website's capabilities, often providing features like custom post types, shortcodes, and layout tools to help site administrators manage content and design elements more effectively.

What does PHP object injection mean for CVE-2026-62105?

This vulnerability, classified as CWE-502, occurs when an application improperly trusts user-provided data. By sending a malicious object to the plugin, an attacker can manipulate how the website handles data, potentially forcing the server to execute unintended commands or take actions not intended by the site developers.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specifically crafted, unsanitized input to the plugin. It does not require the attacker to log in or have existing permissions. Notably, standard site browsing or legitimate interactions with typical plugin features do not activate the exploit; it requires intentional delivery of a specially formatted malicious payload.

Do I need to worry if my site is not on the internet?

According to Halo Surface Signal, this vulnerability is particularly relevant to public-facing web applications, as the plugin's function makes it accessible over the network. If your WordPress site is strictly internal or isolated from the internet, the attack path is significantly restricted, though local access could still potentially pose a risk depending on your network architecture.

When should I take action to secure my environment?

You should prioritize this immediately. Begin by auditing your systems to identify all instances of the ThemeREX Addons plugin. Once identified, evaluate which sites are reachable from the network and coordinate with your application owners to plan the necessary plugin updates to resolve the flaw.

References

patchstack.com/database/wordpress/plugin/trx_addons/vulnerability/wo…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.