Stargaze WordPress Theme Flaw Exposes Sites to Critical Remote Code Execution
Unauthenticated PHP object injection in Stargaze versions 1.10 and earlier allows attackers to take full control of affected websites.
Key points
- The vulnerability is rated Critical with a CVSS score of 9.8 by the National Vulnerability Database.
- ThemeREX Stargaze versions up to and including 1.10 are affected by the unauthenticated flaw.
- The issue stems from CWE-502, allowing PHP object injection without requiring user login credentials.
Small-business owners relying on the Stargaze WordPress theme face a severe security breach that could lead to complete website compromise. The National Vulnerability Database has assigned CVE-2026-62051 to this flaw, rating it as Critical with a CVSS score of 9.8. This high severity rating indicates that the vulnerability is easily exploitable and requires no user interaction or authentication to trigger.
The risk
The core of the issue is an unauthenticated PHP object injection vulnerability. According to the NVD record, this weakness is classified under CWE-502. Attackers can inject malicious PHP objects into the application without needing to log in or possess valid credentials. This allows them to execute arbitrary code on the server hosting the WordPress site.
Such access enables threat actors to deface websites, steal sensitive data, or pivot to other systems within the network. Because the flaw exists in a widely used theme, the attack surface is broad. Businesses that have not verified their theme versions are potentially exposed to immediate and automated exploitation attempts.
Who is exposed
Any organization using the ThemeREX Stargaze WordPress theme is at risk if they are running version 1.10 or any earlier release. The NVD record explicitly states that versions up to 1.10 are affected. Site administrators must check their current version immediately to determine if their installation falls within this vulnerable range.
WordPress sites often host customer data, payment information, and proprietary business content. A breach through this vector could expose all such data. The lack of authentication requirements makes this particularly dangerous for small businesses that may not have advanced intrusion detection systems in place.
Cost and compliance
The source material does not provide specific financial loss figures or regulatory penalties associated with CVE-2026-62051. However, a critical vulnerability of this nature typically triggers compliance reviews for standards like PCI DSS or GDPR if customer data is compromised. The cost of remediation, including forensic analysis and potential legal fees, can be significant for small organizations.
What happens next
Managers must audit their WordPress installations to identify any use of the Stargaze theme. If the theme is present, verify the version number against the affected range. Organizations should prepare for potential incident response scenarios while monitoring for unauthorized changes or suspicious server activity.
Background: National Vulnerability Database
The National Vulnerability Database is a centralized repository that standardizes information about software weaknesses. It assigns unique identifiers to each flaw, allowing security tools to automatically detect and assess risks in your systems without manual research.
Read the full guide: National Vulnerability Database Explained: How NVD Works for You
What to do and how to stay safe: Stargaze
- Audit all WordPress sites to identify if the Stargaze theme is installed and check the version number.
- Monitor server logs for unusual activity or unauthorized PHP execution attempts on affected sites.
- Restrict admin access and enforce strong authentication protocols to limit potential lateral movement.
- Once the vendor provides an update, apply it immediately to patch the vulnerability.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business
General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of the Stargaze theme are vulnerable?
ThemeREX Stargaze versions 1.10 and earlier are affected by the unauthenticated PHP object injection flaw.
What is the severity rating of CVE-2026-62051?
The National Vulnerability Database rates the vulnerability as Critical with a CVSS score of 9.8.
Do attackers need to log in to exploit this flaw?
No, the vulnerability allows for unauthenticated exploitation, meaning no login credentials are required.
