Key points
- The National Vulnerability Database rates CVE-2026-62051 as critical with a CVSS score of 9.8.
- The flaw affects Stargaze theme versions 1.10 and earlier provided by ThemeREX.
- The vulnerability is classified under CWE-502, indicating an unauthenticated PHP object injection weakness.
A critical security flaw has been identified in the Stargaze WordPress theme, allowing unauthenticated attackers to inject PHP objects. This vulnerability, tracked as CVE-2026-62051, affects theme versions up to 1.10 and carries a maximum CVSS score of 9.8.
What happened
The National Vulnerability Database recorded CVE-2026-62051 as a critical severity issue affecting the Stargaze WordPress theme. The vulnerability permits unauthenticated PHP object injection in versions 1.10 and earlier of the software. ThemeREX is the vendor responsible for the Stargaze theme distribution.
The weakness is categorised under CWE-502 by the Common Weakness Enumeration. This classification indicates that the application fails to properly sanitise user input before using it to instantiate objects. Attackers can exploit this by sending crafted requests that trigger arbitrary code execution on the server.
The flaw does not require any form of authentication to exploit. This means any internet-facing website running the affected versions of the Stargaze theme is potentially vulnerable. The high CVSS score of 9.8 reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability.
Why it matters
Organisations using the Stargaze theme face immediate risk of remote code execution. Because the injection is unauthenticated, attackers do not need valid user credentials to compromise the system. This significantly lowers the barrier for malicious actors targeting WordPress sites.
The Stargaze theme is a popular choice for many WordPress installations. Widespread use increases the attack surface for this specific vulnerability. Security teams must verify their current version status to determine exposure.
The absence of authentication requirements means automated scanning tools can easily identify and exploit vulnerable instances. This makes the vulnerability attractive for large-scale botnet campaigns or opportunistic attackers. The critical rating underscores the urgency for affected organisations to address the issue.
What happens next
- Review current WordPress installations to identify if the Stargaze theme is active.
- Check the version number of the Stargaze theme against the affected range.
- Isolate any systems running versions 1.10 or older from public internet access.
- Monitor server logs for unusual activity indicative of object injection attempts.
Background: Botnets
Botnets infect devices to steal bandwidth or launch attacks. Small firms suffer because they lack visibility and patching discipline. Protect against this by enforcing strict network segmentation, disabling unused remote access protocols, and verifying that your IT provider monitors for anomalous outbound traffic rather than just inbound threats.
Read the full guide: Botnets: Why Small Teams Get Hijacked and How to Stop It
What to do and how to stay safe: Stargaze
- Audit all WordPress sites for the presence of the Stargaze theme and verify version numbers.
- Implement web application firewalls to filter malicious payloads targeting PHP object deserialization.
- Restrict access to administrative interfaces using IP whitelisting or multi-factor authentication.
- Prepare an incident response plan in case remote code execution is detected on affected servers.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritise Fixes That Matter
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of the Stargaze theme are affected by CVE-2026-62051?
Versions 1.10 and earlier of the ThemeREX Stargaze WordPress theme are affected by this vulnerability.
What is the severity rating of CVE-2026-62051?
The National Vulnerability Database rates CVE-2026-62051 as critical with a CVSS score of 9.8.
Does exploiting this vulnerability require user login?
No, the vulnerability allows unauthenticated PHP object injection, meaning no login is required.
