How Does CVE-2026-62045 Endanger Booklovers WordPress Sites With Untrusted Data Deserialization?

The Booklovers WordPress theme contains a critical security flaw that allows attackers to inject objects into affected systems without authentication. The National Vulnerability Database identifies this issue as CVE-2026-62045, assigning it a maximum CVSS score of 9.8. This rating indicates a severe risk to any WordPress installation using the vulnerable theme versions.

What is the technical nature of CVE-2026-62045?

The vulnerability stems from the improper handling of serialized data within the theme’s codebase. According to the NVD record, the issue is categorized under CWE-502, which refers to the deserialization of untrusted data. When an application deserializes data without sufficient validation, it can execute arbitrary code or manipulate application state. In this specific case, the flaw enables object injection, allowing malicious payloads to be processed by the theme.

Which versions of the Booklovers theme are affected?

The Booklovers theme is vulnerable in all versions up to and including 2.13.0. The NVD record specifies that the issue affects the theme "from n/a through 2.13.0," indicating that the initial release contains the flaw and it persists through that specific update. ThemeREX Group is the vendor responsible for the Booklovers theme. Any site running version 2.13.0 or earlier is exposed to this object injection risk.

Why is this vulnerability rated as critical?

A CVSS score of 9.8 places CVE-2026-62045 in the critical severity range. This high score reflects the ease with which an attacker can exploit the flaw. Because the object injection can be performed without authentication, remote attackers do not need valid user credentials to target vulnerable sites. The lack of required access controls significantly amplifies the potential impact on website security and data integrity.

Is a patch available for this issue?

As of the current reporting, the source material does not confirm the release of a patched version beyond 2.13.0. The NVD record lists the affected range ending at 2.13.0 but does not specify a fixed version. Users should monitor official channels from ThemeREX Group for updates. Until a confirmed fix is released, sites running vulnerable versions remain at risk of exploitation through this unauthenticated object injection vector.

What to do and how to stay safe: Booklovers

• Audit your WordPress installation to check if the Booklovers theme is installed and identify its current version.
• If running version 2.13.0 or earlier, consider switching to a different theme until a secure update is confirmed.
• Monitor ThemeREX Group announcements for a patched version that resolves CVE-2026-62045.
• Review server logs for unusual activity or unauthorized object deserialization attempts on affected sites.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-62045?

CVE-2026-62045 is a critical vulnerability in the Booklovers WordPress theme that allows unauthenticated object injection through deserialization of untrusted data.

Which Booklovers theme versions are vulnerable?

All versions of the Booklovers theme from the initial release through version 2.13.0 are affected by this security flaw.

What is the CVSS score for this vulnerability?

The National Vulnerability Database assigns a CVSS score of 9.8 to CVE-2026-62045, classifying it as critical.