ThemeREX Vagabonds CVE-2026-112856

The flaw is PHP Object Injection via deserialization of untrusted data in the Vagabonds theme (versions up to and including 1.3.10); the supplied CVSS vector is AV:N/AC:L/PR:N/UI:N, indicating remote unauthenticated reach with no user interaction. The specific endpoint or parameter that feeds attacker data into unserialize() is NOT described in the available sources. The key practical limiter for this CWE-502 class is that meaningful impact (code execution, file write/read, or DoS) requires a usable POP gadget chain to be present in the theme, an installed plugin, or WordPress core - object injection alone without a reachable gadget yields limited effect; the presence of such a chain is not confirmed in the data. Exploitation also presupposes the Vagabonds theme is installed and active at version ≤1.3.10.

This is a CWE-502 PHP Object Injection flaw in the ThemeREX 'Vagabonds' WordPress theme (through 1.3.10), rated CVSS 9.8 with vector AV:N/AC:L/PR:N/UI:N and full High confidentiality/integrity/availability impact - i.e. remote, unauthenticated, low-complexity with no user interaction per the supplied vector. The vuln.today Decision label is act_now, and the source is Patchstack, a credible WordPress-vulnerability authority. However, several high-signal exploitation indicators are absent from the input: there is NO EPSS score, NO CISA KEV listing, and no PoC or exploit reference beyond the Patchstack advisory itself, so active or widespread exploitation is NOT demonstrated by the data. The act_now label and 9.8 score therefore rest on severity/exploitability theory (unauthenticated deserialization) rather than observed exploitation. A critical caveat for CWE-502 object injection: actual code execution or HIGH impact is not automatic - it requires a usable POP (property-oriented programming) gadget chain reachable in the theme, installed plugins, or WordPress core; the description does not state whether such a chain exists or how the sink is reached, so the C:H/I:H/A:H claim should be treated as worst-case potential. Net: treat as a genuine high priority to patch given unauthenticated network reach and a reputable reporter, but note the real-world exploitation evidence is thin and the impact ceiling is gadget-chain-dependent.

A remote, unauthenticated attacker sends crafted serialized PHP data to a Vagabonds theme endpoint that passes it to unserialize(), triggering PHP Object Injection. If a suitable POP gadget chain is present in the theme, an installed plugin, or WordPress core, the injected object can be abused to achieve impacts such as file operations or code execution; without such a chain, impact is limited. No public exploit code or PoC is identified in the available data.