{"id":"CVE-2026-62125","published":"2026-10-10T20:16:44.660","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/asia-garden/vulnerability/wordpress-asia-garden-theme-1-3-1-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A PHP object injection vulnerability allows remote attackers to execute arbitrary code by injecting serialized objects into untrusted input streams. This critical flaw can lead to complete system compromise without requiring authentication.","exploitability":"Exploitation is relatively straightforward as it requires only sending a specially crafted serialized object in an HTTP request, with no authentication or user interaction needed.","blast_radius":"The vulnerability affects all installations of Asia Garden version 1.3.1 and earlier, potentially allowing attackers to gain full control over affected systems through remote code execution.","remediation":"Upgrade to version 1.3.2 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","php","unauthenticated","injection"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:47:55.934Z"}}