EUVD-2026-108952
GHSA-xp4q-vm3g-g3h3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ZenSoul deserialization endpoint
-
DeliverySubmit crafted serialized PHP object
-
ExploitTrigger object injection (CWE-502)
-
ExecutionInvoke POP gadget chain
-
ImpactCompromise site data or code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected component is the ThemeREX ZenSoul WordPress theme at versions through 1.13; the site must run this theme. The description states only that untrusted data is deserialized, enabling PHP Object Injection - it does NOT name the specific endpoint, parameter, feature, or configuration that reaches the deserialization, nor whether a POP gadget chain is present, so the exact trigger is not described in the available sources. Per the supplied CVSS vector (PR:N/UI:N) no authentication or user interaction is required, but practical impact of PHP object injection typically depends on the presence of a usable gadget chain in the theme, WordPress core, or loaded plugins - a limiting factor not confirmed by the evidence. |
| Impact | The signals are mixed. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) describes a maximally severe network, unauthenticated flaw with full confidentiality, integrity and availability impact, and the vuln.today decision label is act_now. CWE-502 (deserialization of untrusted data leading to PHP Object Injection) in a WordPress theme is a genuinely dangerous class, since a usable POP gadget chain can yield remote code execution or data compromise. However, several real-world risk modifiers are absent from the input: no EPSS exploitation probability is provided, the vulnerability is NOT on the CISA KEV list (so there is no confirmation of active exploitation), and no working exploit code is supplied - the sole reference is the Patchstack database advisory, not a PoC. The description also does not state how the deserialization is reached (which endpoint, parameter, or whether a gadget chain is present in the theme or a bundled dependency), so the practical exploitability behind the 9.8 is not demonstrated in the available evidence. Net: treat as high-priority per the act_now label and CVSS, but note that exploitation remains unproven and the real footprint is limited by the niche nature of the affected theme. |
| Exploit ScenarioDerived | A remote attacker sends a crafted request carrying a malicious serialized PHP object to a ZenSoul theme endpoint that deserializes untrusted input; if a suitable POP gadget chain is reachable, this triggers object injection leading to data compromise or code execution. The specific trigger and any gadget chain are not described in the available sources, and no working public exploit is provided - only the Patchstack advisory. Per the CVSS vector this would require no authentication and no user interaction, with low attack complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 23, 2026
PHP object injection through deserialization of untrusted data affects the ThemeREX ZenSoul WordPress theme at all versions through 1.13, exposed over the network with a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) per the supplied vector. The available sources do not identify the specific endpoint, parameter, or theme feature that reaches the unsafe deserialization, nor whether a usable POP gadget chain exists in the theme, WordPress core, or installed plugins - a factor that typically governs whether object injection escalates to code execution, file operations, or data disclosure. No confirmation of active exploitation (CISA KEV) or verified working exploit code was provided; a public reference exists at the Patchstack vulnerability database entry, and the site's priority label is act_now.
RemediationAI
No vendor-released patch or fixed version is identified in the supplied data, so remediation must begin with confirming theme status: if ZenSoul is not required, deactivate and remove it, which removes the attack surface entirely; if it is required, check the vendor (ThemeREX) and the Patchstack advisory at https://patchstack.com/database/wordpress/theme/zensoul/vulnerability/wordpress-zensoul-theme-1-13-php-object-injection-vulnerability?_s_id=cve for a release newer than 1.13 and apply it as soon as one is published. Because the vulnerable endpoint and input path are not described, targeted virtual patching is not possible from this data; a WAF rule set covering WordPress theme request parameters offers only generic, incomplete coverage and can be bypassed, and it should not be treated as a substitute for removing or updating the theme. Reducing the number of active plugins and unused theme code lowers the chance that a usable gadget chain is available, at the cost of losing plugin functionality, and monitoring for unexpected file changes or serialized-input anomalies provides detection rather than prevention.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability class is CWE-502, Deserialization of Untrusted Data, in a WordPress theme (CPE cpe:2.3:a:themerex:zensoul - all versions through 1.13). In PHP, unsafe use of unserialize() on attacker-influenced input lets an attacker supply a serialized string that instantiates arbitrary classes and drives their magic methods (__wakeup, __destruct, __toString), i.e. PHP Object Injection. The immediate effect is limited to objects the codebase actually defines; meaningful impact - remote code execution, arbitrary file deletion, SQL injection, or privilege escalation - requires a gadget chain assembled from classes present in the theme, WordPress core, or bundled/loaded plugins. The supplied CVSS vector (PR:N/UI:N) indicates no authentication or interaction prerequisite, but the sources do not name the vulnerable endpoint, the serialized input's entry point, or the presence of any gadget chain, so the practical exploit path and final impact remain unverified beyond the assessed vector.
Know when Zensoul gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Patchstack-class unauthenticated object injection is typically network-reachable with no privileges or interaction; C/I/A set High for object injection's RCE/data potential, though the exact trigger is not described.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.
Articles & Coverage 1
Executive ViewAI
The ThemeREX ZenSoul WordPress theme (versions through 1.13) contains a critical PHP object injection vulnerability that could allow an unauthenticated attacker to fully compromise affected websites. If exploited, this could lead to unauthorized access, data theft, or complete site takeover, affecting any organization hosting this theme. Leadership should prioritize immediate remediation because no vendor patch is currently available and the vulnerability is rated critical with a high likelihood of exploitation.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling the vulnerable theme, blocking exploit attempts via WAF, and monitoring for suspicious activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB