CVE-2026-62051: Stargaze PHP Object Injection Vulnerability

CVE-2026-62051 Overview

CVE-2026-62051 is an unauthenticated PHP Object Injection vulnerability affecting the Stargaze WordPress theme in versions 1.10 and earlier. The flaw stems from insecure deserialization of untrusted input [CWE-502], allowing remote attackers to inject crafted PHP objects without any authentication. Successful exploitation can lead to remote code execution, data tampering, or complete site compromise when a suitable gadget chain is present in the WordPress environment.

Critical Impact
Unauthenticated remote attackers can trigger PHP object instantiation on vulnerable Stargaze theme installations, potentially leading to arbitrary code execution and full site takeover.

Affected Products

Stargaze WordPress theme versions <= 1.10
WordPress sites running the vulnerable theme with public-facing endpoints
Hosting environments exposing deserialization sinks reachable from the network

Discovery Timeline

2026-10-10 - CVE-2026-62051 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-62051

Vulnerability Analysis

The vulnerability is an unauthenticated PHP Object Injection in the Stargaze theme. PHP Object Injection occurs when user-controlled data reaches a deserialization function such as unserialize() without validation. An attacker supplies a serialized object payload that, upon deserialization, instantiates arbitrary classes already loaded in the PHP runtime.

In WordPress environments, the deserialized objects often trigger magic methods such as __wakeup(), __destruct(), or __toString(). These methods can chain into existing "POP gadgets" within WordPress core, plugins, or other themes. The chained gadgets may lead to file writes, SQL execution, or arbitrary command execution.

Because the attack vector is network-based and requires no authentication or user interaction, any internet-accessible WordPress site running Stargaze <= 1.10 is exposed.

Root Cause

The root cause is improper handling of untrusted serialized data by the theme. The theme passes attacker-controlled input into a deserialization function without filtering or type restrictions, violating safe deserialization practices described in [CWE-502].

Attack Vector

An attacker crafts a serialized PHP payload containing a gadget chain and submits it to a vulnerable endpoint exposed by the Stargaze theme. The server deserializes the payload, instantiating attacker-chosen classes and triggering their magic methods. Depending on the gadgets available, this can escalate to arbitrary code execution within the web server process.

No verified public proof-of-concept is listed in the enriched data. Technical details on the affected sink are available in the Patchstack advisory.

Detection Methods for CVE-2026-62051

Indicators of Compromise

HTTP requests containing serialized PHP markers such as O:, a:, or s: in query strings, POST bodies, or cookies targeting Stargaze theme endpoints
Unexpected PHP processes spawning shells, writing to wp-content/uploads, or making outbound network connections
New or modified PHP files in theme and plugin directories not tied to legitimate updates
Admin user creation or privilege changes in the WordPress wp_users and wp_usermeta tables without a corresponding administrator action

Detection Strategies

Inspect web server logs for suspicious parameters containing serialized object patterns directed at /wp-content/themes/stargaze/ paths
Enable WordPress file integrity monitoring to flag unauthorized changes to theme, plugin, and core files
Deploy web application firewall rules that block or alert on serialized PHP payloads in HTTP requests

Monitoring Recommendations

Centralize WordPress, PHP-FPM, and web server logs for correlation and anomaly detection
Monitor outbound connections from the web server to detect post-exploitation command-and-control traffic
Alert on new scheduled tasks (wp_cron entries) or modifications to wp-config.php

How to Mitigate CVE-2026-62051

Immediate Actions Required

Identify all WordPress installations using the Stargaze theme and inventory version numbers
Take vulnerable sites offline or place them behind a web application firewall until patched
Rotate WordPress administrator credentials, API keys, and database passwords if compromise is suspected
Audit wp-content/, wp-config.php, and user tables for signs of unauthorized modification

Patch Information

At the time of publication, remediation guidance is tracked in the Patchstack advisory for the Stargaze theme. Upgrade to a version later than 1.10 once the vendor publishes a fixed release, or replace the theme if no patched version is available.

Workarounds

Deactivate and remove the Stargaze theme if a patched version is not yet available
Deploy WAF signatures that block HTTP requests containing PHP serialization patterns targeting theme endpoints
Restrict access to the WordPress site using IP allowlists while remediation is in progress
Disable unauthenticated endpoints exposed by the theme at the web server configuration layer

bash

# Example WAF-style ModSecurity rule to block serialized PHP payloads
SecRule ARGS|REQUEST_COOKIES|REQUEST_HEADERS "@rx (?:^|[^a-z])O:\d+:\"[A-Za-z_\\\\]+\"" \
    "id:1026062051,phase:2,deny,status:403,log,msg:'Possible PHP Object Injection (CVE-2026-62051)'"