9.8 Critical: ThemeREX Stargaze v1.10 Has Unauthenticated PHP Object Injection CVE-2026-62051

The National Vulnerability Database published CVE-2026-62051 on the current date, assigning it a critical severity rating of 9.8 out of 10. This high score indicates that the vulnerability allows for unauthenticated PHP object injection within the Stargaze WordPress theme. Managed service providers must assess their client portfolios immediately to identify any installations of ThemeREX Stargaze versions 1.10 or lower. The critical rating reflects the ease with which an attacker can exploit this weakness without needing credentials or prior access to the system.

By the numbers

• 9.8 is the CVSS base score assigned to CVE-2026-62051 by the National Vulnerability Database.
• 1.10 is the maximum affected version number for the ThemeREX Stargaze WordPress theme.
• CWE-502 is the specific weakness classification for this unauthenticated PHP object injection flaw.

What the figures mean

A CVSS score of 9.8 places this vulnerability in the highest risk category, signaling severe potential impact on confidentiality, integrity, and availability. The CWE-502 classification confirms that the flaw stems from improper neutralization of special elements in objects during deserialization. Because the injection is unauthenticated, attackers do not need valid user credentials to trigger the exploit.

This lowers the barrier to entry for malicious actors significantly. ThemeREX Stargaze versions up to 1.10 are exposed to this attack vector, leaving any unpatched instance vulnerable to remote code execution or data theft. The lack of authentication requirements means that automated scanning tools can easily identify and exploit these sites at scale.

What should you do?

Managed service providers should prioritize inventory checks across all managed WordPress environments to locate Stargaze theme installations. Identify any sites running version 1.10 or older, as these are directly affected by CVE-2026-62051. Monitor web server logs for unusual deserialization attempts or unexpected object creation activities. Since no fix has been confirmed yet in the source material, consider isolating affected environments if possible. Keep a close watch on ThemeREX announcements for an official security patch. Until a vendor update is available, restrict administrative access and enhance monitoring on affected sites to detect potential exploitation attempts early.

Background: WordPress theme vulnerabilities

Isolate the server from the internet immediately. Do not restore backups without scanning them. Replace the compromised theme with a clean version from the official repository. Audit user accounts for unauthorized administrators. Rotate all credentials and database passwords. Review server logs to determine the entry point.

Read the full guide: WordPress Theme Vulnerabilities: Response and Recovery Steps

What to do and how to stay safe: CVE-2026-62051

• Audit all managed WordPress sites to identify installations of the Stargaze theme version 1.10 or earlier.
• Monitor server logs for signs of unauthorized PHP object deserialization or unusual script execution.
• Restrict external access to affected sites where possible until a vendor patch is available.
• Notify clients of the critical risk associated with CVE-2026-62051 and the need for immediate attention.

General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of the Stargaze theme are affected by CVE-2026-62051?

All versions of the ThemeREX Stargaze WordPress theme up to and including version 1.10 are affected.

What is the severity rating of this vulnerability?

The National Vulnerability Database rates CVE-2026-62051 as critical with a CVSS score of 9.8.

Is there a patch available for this vulnerability?

No fix has been confirmed yet in the available source material; users should wait for an official vendor update.