Booklovers WP Theme Deserialization Bug Lets Attackers Inject Objects Remotely in Versions Up to 2.13.0

The National Vulnerability Database has assigned CVE-2026-62045 to a critical security flaw in the Booklovers WordPress theme developed by ThemeREX Group. This vulnerability allows for object injection through the deserialization of untrusted data. The issue affects all releases of the Booklovers theme from its initial release through version 2.13.0.

The risk

Object injection vulnerabilities occur when an application processes serialized objects from untrusted sources without proper validation. According to the NVD record, CVE-2026-62045 is classified under CWE-502, which describes the deserialization of untrusted data. This weakness can allow attackers to inject malicious objects that may lead to remote code execution or other severe impacts. The flaw is rated Critical with a CVSS score of 9.8, indicating a high severity level for exploitation.

Who is exposed

Any WordPress site using the Booklovers theme by ThemeREX Group is potentially exposed to this vulnerability. The NVD record specifies that the issue affects versions from n/a through 2.13.0. Small business owners who rely on this theme for their online presence should verify their current version immediately. Sites running version 2.13.0 or earlier are considered vulnerable until a patch is applied.

Cost and compliance

The source material does not provide specific details regarding financial costs or regulatory compliance implications associated with CVE-2026-62045. However, critical vulnerabilities in widely used web components can lead to significant data breaches if exploited. Organizations must consider the potential impact on data integrity and availability when assessing the risk of unpatched systems. No specific compliance frameworks are mentioned in the NVD record.

What to watch

Site administrators should monitor their WordPress installations for any signs of unauthorized activity or unexpected behavior. Keeping an eye on official security advisories from ThemeREX Group is essential for timely updates. Users should also review server logs for any suspicious requests that might indicate an attempt to exploit the deserialization flaw.

What to do and how to stay safe: Booklovers

• Check the current version of the Booklovers theme installed on your WordPress site and compare it against the affected range up to 2.13.0.
• Monitor official channels from ThemeREX Group for security updates or patches addressing CVE-2026-62045.
• Review server access logs for unusual activity that could indicate exploitation attempts of the object injection vulnerability.
• Consider temporarily restricting access to administrative functions if you cannot verify the theme version or apply a fix immediately.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-62045?

CVE-2026-62045 is a critical object injection vulnerability in the Booklovers WordPress theme that allows deserialization of untrusted data.

Which versions of Booklovers theme are affected?

All versions of the ThemeREX Group Booklovers theme from n/a through 2.13.0 are affected by this vulnerability.

What is the CVSS score for this flaw?

The National Vulnerability Database rates CVE-2026-62045 with a CVSS score of 9.8, classifying it as Critical.