CVE-2026-62045

Summary

A critical deserialization vulnerability in Booklovers allows untrusted data to be deserialized, leading to object injection attacks that can result in remote code execution or complete system compromise.

Exploitability

Exploitation is relatively straightforward with no special preconditions required, as the vulnerability occurs during normal deserialization of user-supplied data.

Blast radius

The impact could be severe across all affected installations, potentially allowing attackers to execute arbitrary code on the target system and fully compromise the WordPress site.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Immediate remediation is to upgrade to version 2.13.1 or later, as this release specifically addresses the deserialization vulnerability in ThemeREX Group Booklovers plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.