Critical CVE-2026-62045 in Booklovers Theme Puts Sites at Risk Up to v2.13.0

Small-business owners relying on the Booklovers WordPress theme face immediate exposure to a high-severity security flaw that could allow remote attackers to execute arbitrary code. The National Vulnerability Database lists CVE-2026-62045 as a critical vulnerability, assigning it a maximum CVSS score of 9.8. This rating indicates that the exploit can be triggered remotely without prior authentication, posing a severe threat to website integrity and data confidentiality for organizations using this specific theme.

The risk

The core issue is a deserialization of untrusted data weakness, classified under CWE-502. According to the NVD record, this flaw permits object injection within the Booklovers theme developed by ThemeREX Group. When an application deserializes untrusted data without proper validation, attackers can manipulate the data stream to inject malicious objects. This often leads to remote code execution, allowing adversaries to take full control of the web server hosting the WordPress site.

Who is exposed

Any organization running the Booklovers WordPress theme is potentially vulnerable if they have not upgraded beyond version 2.13.0. The NVD explicitly states that the issue affects Booklovers versions from the initial release through 2.13.0. Small businesses that use this theme for e-commerce or content presentation are particularly at risk, as WordPress sites are frequent targets for automated scanning tools looking for known vulnerabilities.

Cost and compliance

The financial impact of a successful exploit can be significant for small businesses, ranging from downtime costs to data breach notification requirements. While the source material does not detail specific regulatory penalties, a CVSS 9.8 rating typically triggers immediate incident response protocols. Organizations must assess whether customer data was accessed during any potential exploitation window. Compliance frameworks often require rapid patching of critical vulnerabilities to maintain certification and insurance coverage.

What happens next

Managers should immediately audit their WordPress installations to identify if the Booklovers theme is active. If the theme version is 2.13.0 or lower, it is vulnerable to object injection. Until a secure update is available from the vendor, organizations should consider disabling the theme or restricting access to the affected site to mitigate the risk of remote code execution.

Background: National Vulnerability Database

The National Vulnerability Database is a centralized repository that standardizes information about software weaknesses. It assigns unique identifiers to each flaw, allowing security tools to automatically detect and assess risks in your systems without manual research.

Read the full guide: National Vulnerability Database Explained: How NVD Works for You

What to do and how to stay safe: CVE-2026-62045

• Audit your WordPress plugins and themes to identify if Booklovers version 2.13.0 or earlier is installed.
• Monitor server logs for unusual activity or unauthorized file changes that may indicate exploitation.
• Restrict administrative access to your WordPress dashboard using IP whitelisting or multi-factor authentication.
• Once the vendor provides an update, apply the patch immediately to resolve the deserialization flaw.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-62045?

The National Vulnerability Database rates CVE-2026-62045 as critical with a CVSS score of 9.8.

Which versions of the Booklovers theme are affected?

All versions of the ThemeREX Group Booklovers theme up to and including version 2.13.0 are affected.

What type of vulnerability is this?

It is a deserialization of untrusted data vulnerability, specifically allowing object injection, classified as CWE-502.