9.8Crítica

CVE-2026-62011WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability

ThemeREX Bonbon Publicada: 2026-10-29 18:24 (hace 4 días)

Descripción

Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

Debilidad (CWE): CWE-502

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
ThemeREX	Bonbon	≤ 1.11

Referencias y parches

https://patchstack.com/database/wordpress/theme/bonbon/vulnerability/wordpress-bonbon-theme-1-11-php-object-i… vdb-entry

Puntuación CVSS

9.8Crítica

Fuente: Patchstack · CVSS 3.1

Vector de ataque: Red
Complejidad: Baja
Privilegios: Ninguno
Interacción del usuario: Ninguna
Alcance: Sin cambio
Confidencialidad: Alto
Integridad: Alto
Disponibilidad: Alto

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Todas las puntuaciones (2)

cna	CVSS 3.1	9.8Crítica
audit@patchstack.com	CVSS 3.1	9.8Crítica

EPSS (probabilidad de explotación en 30 días)

0.40%

superior al 34 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: yes
Impacto técnico: total

Cronología

ID reservado2026-07-13
Publicada2026-10-29 18:24
Llegó a IP-DB2026-10-29 19:03
Última actualización2026-10-30 22:18

Asignada por (CNA): Patchstack
Estado en NVD: Deferred

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — WordPress plugins & themes

5.3Media

CVE-2026-103310 hace 8 horas

PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment Notification

PayHere Payment Gateway

The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation a…

6.5Media

CVE-2026-119480 hace 23 horas

WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerability

Crocoblock JetFormBuilder

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

9.3Crítica

CVE-2026-62048 hace 23 horas

WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability

Liquid Web / StellarWP BookIt

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.

7.1Alta

CVE-2026-66570 hace 23 horas

WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability

Nickboss WordPress File Upload

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.1.

5.3Media

CVE-2026-118168 ayer

MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure

MapPress

The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.

4.3Media

CVE-2026-107342 ayer

Kali Forms < 2.4.30 - Subscriber+ User Email Address Disclosure

Kali Forms — Contact Form & Drag-and-Drop Builder

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce that is available to any logged-in user, …