First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-62001

CriticalCVSS 9.8/10Last modified Oct 29, 2026

Description

Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
ThemeREX	Marcell	<= 1.2.14

References

https://patchstack.com/database/wordpress/theme/marcell/vulnerability/wordpress-marcell-theme-1-2-14-php-object-injection-vulnerability?_s_id=cve

Timeline

Published: Oct 29, 2026
Last modified: Oct 29, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-620029.8Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.CVE-2026-620039.8Unauthenticated PHP Object Injection in Mission <= 1.22 versions.CVE-2026-620049.8Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.CVE-2026-620059.8Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.CVE-2026-620069.8Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.CVE-2026-620077.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements CVE-2026-620089.8Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.CVE-2026-620099.8Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.CVE-2026-62015.4A vulnerability was identified in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /jobs/job-delete.CVE-2026-620109.8Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.CVE-2026-620119.8Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.CVE-2026-620129.8Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

CVE-2026-62001: Critical severity, CVSS 9.8 | Vulnix