CVE-2026-62018

Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

Risk score: 74/100
CVSS: 9.8 v3.1
Published: 29 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: A critical vulnerability (CVSS 9.8) allows unauthenticated PHP Object Injection in Gunslinger versions up to 1.11, enabling an attacker to potentially gain high privileges, inject code, and achieve arbitrary code execution.
Affected: {'products': ['Gunslinger'], 'packages': [], 'versions': ['<= 1.11']}
Fix: Check the linked advisory for a fix, as none is provided.
Exploitation: No known exploitation

Why it is Amber

CVSS 9.8 critical
Remotely exploitable without logging in
On your watchlist: php

References

https://patchstack.com/database/wordpress/theme/gunslinger/vulnerability/wordpress-gunslinger-theme-1-11-php-object-injection-vulnerability?_s_id=cve

Original description

Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

Last activity 29 Oct 2026. Patch Forecast updates every hour.