{"id":"CVE-2026-62086","published":"2026-10-10T20:16:42Z","modified":"2026-10-13T13:28:15Z","title":"Unauthenticated PHP Object Injection in Juno <= 2.25 versions","vendor":"ThemeREX","product":"Juno","tier":"core","eol":null,"description":{"text":"Unauthenticated PHP Object Injection in Juno <= 2.25 versions.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a PHP object injection (insecure deserialization of untrusted data) in ThemeREX's Juno WordPress theme, affecting versions 2.25 and earlier. An unauthenticated remote attacker can exploit it over the network without user interaction or prior authentication, by supplying crafted serialized input that the affected Juno component deserializes.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:19:36Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00375,"percentile":0.3148,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":10,"pulses":[{"name":"Known_Cve | Oct 21, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad781365a703b9c48649e66","created":"2026-10-20"},{"name":"Known_Cve | Oct 20, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad62f6910d6449918d5e634","created":"2026-10-19"},{"name":"Known_Cve | Oct 19, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad4dda86020bf504fd274dd","created":"2026-10-18"},{"name":"Known_Cve | Oct 18, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad38c282daff94afd324191","created":"2026-10-17"},{"name":"Known_Cve | Oct 17, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad23ab08ed96f8b8bdea241","created":"2026-10-16"},{"name":"Known_Cve | Oct 16, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ad0e933fc9a5a47b66d7921","created":"2026-10-15"},{"name":"Known_Cve | Oct 15, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6acf9878b4135e4a2037eb34","created":"2026-10-14"},{"name":"Known_Cve | Oct 14, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ace4672cf606a4598005652","created":"2026-10-13"},{"name":"Known_Cve | Oct 13, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6accf72a849f791bc729312a","created":"2026-10-12"},{"name":"Known_Cve | Oct 12, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6acba8aca71285f9db866402","created":"2026-10-11"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/junotoys/vulnerability/wordpress-juno-theme-2-25-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-96491","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-96491","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62086","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":15.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":6.3,"detail":"percentile 0.3148"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.36,"detail":"10 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}