PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-66650 Theme-Rex CVE debrief

Unauthenticated PHP Object Injection vulnerability in FreightCo theme versions <= 1.1.15. This critical vulnerability allows for potential code execution, data breaches, and system compromise. Defenders of systems using FreightCo theme versions <= 1.1.15 should verify and patch vulnerable systems to prevent potential impacts. The CVE record and NIST NVD detail page confirm vulnerability existence, providing source-confidence.

Vendor
Theme-Rex
Product
FreightCo
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-24
Original CVE updated
2026-10-12
Advisory published
2026-08-24
Advisory updated
2026-10-12

Who should care

Defenders of systems using FreightCo theme versions <= 1.1.15 should verify and patch vulnerable systems.

Why it matters

CVE-2026-66650 is a critical Unauthenticated PHP Object Injection vulnerability in FreightCo theme versions <= 1.1.15. Defenders should verify and patch vulnerable systems to prevent potential code execution, data breaches, and system compromise.

  • Potential for unauthenticated code execution
  • Possible data breaches due to injection vulnerability
  • System compromise and integrity loss

Technical summary

CVE-2026-66650 is an Unauthenticated PHP Object Injection vulnerability in FreightCo theme versions <= 1.1.15. This vulnerability has a high CVSS score of 9.8 and is considered critical. It may allow for unauthenticated code execution, possible data breaches due to injection vulnerability, and system compromise and integrity loss. The official CVE Program record and NIST NVD (

Defensive priority

High priority for version verification and patching

Recommended defensive actions

  • Verify FreightCo theme version and patch to 1.1.16 or later
  • Restrict access to vulnerable systems until patched
  • Monitor for potential exploitation attempts

Evidence notes

Official CVE Program record and NIST NVD detail page confirm vulnerability existence.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-66650 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-66650

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-66650 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-66650

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.