CVE-2026-62008

36th percentile - higher than 36% of all known CVEs

PHP Object Injection vulnerability in the Orpheus theme in versions up to and including 1.8. It can be exploited without authentication, allowing an attacker to inject a malicious PHP object.

An unauthenticated attacker can exploit the vulnerability to inject a PHP object, potentially leading to remote code execution or other severe impacts depending on available gadgets.

Update Orpheus to a version later than 1.8 or apply available mitigations. Consider auditing the code for unsafe deserialization.