Booklovers Theme Deserialization Flaw CVE-2026-62045 Rated Critical for Versions Up to 2.13.0

The National Vulnerability Database published a record for CVE-2026-62045, identifying a critical security flaw in the Booklovers WordPress theme developed by ThemeREX Group. This vulnerability allows for object injection through the deserialization of untrusted data, creating a significant risk for websites using the affected software.

Security researchers have rated the issue with a CVSS score of 9.8, which places it in the highest severity category. The flaw stems from CWE-502, a weakness where applications deserialize data without proper validation. This can allow attackers to inject malicious objects into the application memory, potentially leading to remote code execution or other severe compromises.

Context and Background

The National Vulnerability Database describes the issue specifically as a "Deserialization of Untrusted Data vulnerability." In web applications, deserialization converts a stream of data back into an object. If the application does not verify the source or integrity of this data, an attacker can manipulate the input.

According to the NVD record, this specific instance allows for object injection. This means an attacker can craft malicious data that, when processed by the Booklovers theme, creates objects with unintended properties or behaviors. Such injections often bypass standard input filters because they occur at the object level rather than the string level.

Who Is Affected

The vulnerability impacts all versions of the Booklovers theme up to and including version 2.13.0. The NVD record states the issue affects Booklovers "from n/a through 2.13.0," indicating that no version prior to 2.13.0 is considered safe from this specific defect.

ThemeREX Group is the vendor responsible for the Booklovers theme. Organizations and individuals running WordPress sites with this theme installed are directly exposed to the risk. Until a patched version is released and applied, any site running version 2.13.0 or earlier remains vulnerable to exploitation via this untrusted data deserialization flaw.

Our take on the response

No official patch or fix has been confirmed yet by ThemeREX Group or listed in the source material. Site administrators should monitor vendor communications closely for an update. In the interim, the high CVSS score suggests that active exploitation is a realistic threat, especially for high-traffic sites.

Organizations should prioritize auditing their WordPress installations to identify if Booklovers is active. If the theme is not currently in use, deactivating and deleting it may reduce the attack surface. However, the most effective mitigation remains applying the vendor’s update once it becomes available.

Background: CVSS score

The Common Vulnerability Scoring System (CVSS) assigns a numerical score from 0.0 to 10.0 to software vulnerabilities. It calculates this number by weighing factors like attack complexity, required privileges, and impact on confidentiality, integrity, and availability. You use the score to compare the severity of different flaws, but you must adjust for your own context to prioritize fixes correctly.

Read the full guide: How CVSS Scores Work: The Math Behind Vulnerability Ratings

What to do and how to stay safe: Booklovers

• Audit your WordPress installation to check if the Booklovers theme is installed and active.
• Verify the current version of the theme; if it is 2.13.0 or lower, it is vulnerable.
• Monitor official ThemeREX Group channels for a security patch or update.
• Restrict administrative access to your WordPress dashboard to reduce the risk of compromise.

Step-by-step guide: Vulnerability Prioritization for Small Businesses

General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-62045?

The National Vulnerability Database rates the vulnerability as 9.8, which is considered critical.

Which versions of the Booklovers theme are affected?

All versions of the Booklovers theme up to and including version 2.13.0 are affected.

What type of vulnerability is this?

It is a Deserialization of Untrusted Data vulnerability, specifically allowing object injection.