9.8Crítica

CVE-2026-62001WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

ThemeREX Marcell Publicada: 2026-10-29 18:24 (hace 7 días)

Descripción

Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

Debilidad (CWE): CWE-502

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
ThemeREX	Marcell	≤ 1.2.14

Referencias y parches

https://patchstack.com/database/wordpress/theme/marcell/vulnerability/wordpress-marcell-theme-1-2-14-php-obje… vdb-entry

Puntuación CVSS

9.8Crítica

Fuente: Patchstack · CVSS 3.1

Vector de ataque: Red
Complejidad: Baja
Privilegios: Ninguno
Interacción del usuario: Ninguna
Alcance: Sin cambio
Confidencialidad: Alto
Integridad: Alto
Disponibilidad: Alto

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Todas las puntuaciones (2)

cna	CVSS 3.1	9.8Crítica
audit@patchstack.com	CVSS 3.1	9.8Crítica

EPSS (probabilidad de explotación en 30 días)

0.48%

superior al 41 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: yes
Impacto técnico: total

Cronología

ID reservado2026-07-13
Publicada2026-10-29 18:24
Llegó a IP-DB2026-10-29 19:03
Última actualización2026-10-29 21:17

Asignada por (CNA): Patchstack
Estado en NVD: Deferred

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — WordPress plugins & themes

2.2Baja

CVE-2026-107776 hace 9 horas

Dokan < 5.3.3 - Vendor+ Reverse Withdrawal Ledger Credit Without Payment via Discount Coupon

Dokan

The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less …

9.8Crítica

CVE-2026-100109 hace 9 horas

Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user

Security For WooCommerce

The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated att…

Sin puntuación

CVE-2026-109150 hace 11 horas

WP PageNavi Style <= 1.4 - Stored XSS via CSRF

WP PageNavi Style

The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is…

Sin puntuación

CVE-2026-107773 hace 11 horas

Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order informatio…

Sin puntuación

CVE-2026-107774 hace 11 horas

Dokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact Form

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly …

Sin puntuación

CVE-2026-107775 hace 11 horas

Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsit…