{"id":"CVE-2026-62086","published":"2026-10-10T20:16:42.377","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated PHP Object Injection in Juno <= 2.25 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/junotoys/vulnerability/wordpress-juno-theme-2-25-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical PHP object injection vulnerability exists in Juno versions up to 2.25, allowing unauthenticated attackers to inject arbitrary PHP objects and potentially execute remote code or manipulate application state.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and can be performed via crafted HTTP requests, though the exact payload construction may require some reverse engineering of the target's object structure.","blast_radius":"The vulnerability could affect a wide range of Juno installations, potentially allowing attackers to execute arbitrary code on affected systems or gain full administrative control over the application.","remediation":"Upgrade to version 2.26 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","php","web","injection"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:47:26.902Z"}}