Orgs Urged to Patch Booklovers Theme: Unauthenticated Object Injection Flaw Hits v2.13.0 and Earlier
A severe vulnerability in the Booklovers WordPress theme allows unauthenticated object injection, affecting all versions up to 2.13.0.
Key points
- The flaw is tracked as CVE-2026-62045 and carries a CVSS score of 9.8, classified as Critical.
- It enables object injection through the deserialization of untrusted data within the ThemeREX Group Booklovers theme.
- All versions of the Booklovers theme up to and including version 2.13.0 are affected by this security issue.
Security teams managing WordPress environments must urgently assess their installations for the Booklovers theme. A critical vulnerability has been identified that allows attackers to inject objects into the application. This flaw, tracked as CVE-2026-62045, has been assigned a CVSS base score of 9.8 by the National Vulnerability Database. Such a high severity rating indicates that exploitation is technically feasible and could lead to significant compromise of the underlying server infrastructure.
The vulnerability stems from the deserialization of untrusted data, a weakness categorized under CWE-502. According to the NVD record, this issue exists in the Booklovers theme developed by ThemeREX Group. The flaw affects all versions of the theme from its initial release through version 2.13.0. Organizations running these versions are exposed to potential remote code execution attacks if the vulnerability is exploited successfully.
What we know
The National Vulnerability Database lists CVE-2026-62045 as a critical security issue affecting the Booklovers WordPress theme. The specific weakness is identified as CWE-502, which relates to the deserialization of untrusted data. This type of vulnerability often allows attackers to manipulate data structures in memory, potentially leading to object injection scenarios.
The affected software component is the Booklovers theme, which is produced by ThemeREX Group. The NVD record specifies that the vulnerability impacts versions from "n/a" through 2.13.0. This means that any installation using version 2.13.0 or any earlier version is considered vulnerable. No later versions are listed as affected in the current record.
The CVSS score of 9.8 places this vulnerability in the highest severity tier. This rating reflects the ease of exploitation and the potential impact on confidentiality, integrity, and availability. Security analysts note that object injection flaws can be particularly dangerous in web applications like WordPress, where they may bypass standard input validation controls.
Defender's checklist
- Verify the current version of the Booklovers theme installed on all managed WordPress sites.
- Check for any unauthorised changes to theme files that might indicate prior exploitation.
- Review server logs for unusual PHP deserialization attempts or unexpected object creation events.
- Ensure that the web application firewall is configured to block suspicious payload signatures.
Background: WordPress theme vulnerabilities
Stop using free themes from unknown sources and disable file editing in your configuration. Remove unused themes immediately to reduce the attack surface. Verify every update against the original repository to prevent supply chain poisoning before deployment.
Read the full guide: Prevent WordPress Theme Vulnerabilities: Practical Security Measures
What to do and how to stay safe: CVE-2026-62045
- Audit all WordPress installations to identify if the Booklovers theme is present and check its version number.
- Restrict file permissions on theme directories to prevent unauthorised modifications or uploads of malicious scripts.
- Monitor server access logs for anomalous requests that attempt to pass serialized data to theme functions.
- Prepare an incident response plan that includes steps for isolating compromised servers once the vendor provides an update.
Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It
General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which WordPress theme is affected by CVE-2026-62045?
The Booklovers theme, developed by ThemeREX Group, is affected by this critical vulnerability.
What versions of the Booklovers theme are vulnerable?
All versions of the Booklovers theme up to and including version 2.13.0 are affected by CVE-2026-62045.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates CVE-2026-62045 as Critical with a CVSS score of 9.8.
