{"id":"CVE-2026-62051","published":"2026-10-10T20:16:40.387","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/stargaze/vulnerability/wordpress-stargaze-theme-1-10-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical PHP object injection vulnerability exists in Stargaze versions up to 1.10, allowing unauthenticated attackers to inject arbitrary PHP objects and execute code remotely. This flaw enables full system compromise without requiring authentication.","exploitability":"Exploitation is straightforward with no authentication required, needing only a network connection to the vulnerable application to deliver malicious serialized data through HTTP requests.","blast_radius":"The vulnerability could impact thousands of web servers running Stargaze 1.10 or earlier, potentially leading to widespread remote code execution across multiple organizations.","remediation":"Upgrade to Stargaze 1.11 or later immediately to remediate this critical vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","php","web","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:46:57.936Z"}}