Description
Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ThemeREX | Bonbon | ≤ 1.11 | — |
Critical · 9.8
CVE-2026-62011
EUVD-2026-112974GHSA-fm4r-fpc8-3m2w
WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability
Published Oct 29, 2026 · Updated Oct 30, 2026 · Assigned by Patchstack