{"id":"CVE-2026-62052","published":"2026-10-10T20:16:40.510","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/tipsy/vulnerability/wordpress-tipsy-theme-1-6-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical PHP object injection vulnerability exists in Tipsy versions up to 1.6, allowing unauthenticated attackers to inject arbitrary PHP objects and execute code remotely. This flaw enables full system compromise without requiring authentication.","exploitability":"Exploitation is straightforward with no prerequisites, as the vulnerability allows direct object injection from unauthenticated requests.","blast_radius":"The impact could be severe across all installations running Tipsy 1.6 or earlier, potentially leading to complete system takeover and data compromise.","remediation":"Upgrade to Tipsy 1.7 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","php","web"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:47:02.249Z"}}