What is the CVSS score of CVE-2026-25360?

CVE-2026-25360 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Vex are affected by CVE-2026-25360?

The Rascals Vex WordPress theme contains a critical PHP object injection vulnerability (CVE-2026-25360, CVSS 8.8) affecting versions before 1.2.9 that allows unauthenticated attackers to execute…. A patch is available.

How to fix or mitigate CVE-2026-25360?

Within 24 hours: Identify all WordPress instances running Rascals Vex theme and document current versions via admin dashboard or WP-CLI. Within 7 days: Update Rascals Vex theme to version 1.2.9 or later across all affected WordPress installations and verify successful update completion. Within 30 days: Conduct security audit of affected sites for unauthorized code execution, review access logs for exploitation attempts during vulnerable period, and implement WordPress security hardening (disable unnecessary plugins, enforce strong authentication).

Vex CVE-2026-25360

EUVD-2026-15684 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

Deserialization Vex

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:15 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.2.9

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15684

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in rascals Vex vex allows Object Injection.This issue affects Vex: from n/a through < 1.2.9.

AnalysisAI

A deserialization of untrusted data vulnerability exists in the Rascals Vex theme (CWE-502) that allows attackers to perform PHP object injection attacks. The vulnerability affects Vex versions prior to 1.2.9, as confirmed by Patchstack reporting and ENISA EUVD-2026-15684. An attacker exploiting this flaw can inject malicious serialized objects to achieve arbitrary code execution or other malicious outcomes depending on available PHP magic methods in the application environment.

Technical ContextAI

The vulnerability resides in the Rascals Vex WordPress theme (cpe:2.3:a:rascals:vex:*:*:*:*:*:*:*:*) and involves improper handling of PHP object deserialization. CWE-502 describes the core issue: when an application deserializes untrusted data without proper validation, an attacker can craft malicious serialized objects that trigger arbitrary method execution through PHP magic methods such as __wakeup(), __destruct(), or __toString(). This is particularly dangerous in WordPress theme contexts where user-supplied input may be unsanitized and passed to PHP's unserialize() function. The attack vector likely involves POST parameters, cookies, or stored data that the theme processes without adequate sanitization or type checking.

RemediationAI

Immediately upgrade the Rascals Vex theme to version 1.2.9 or later. This patch version includes fixes for the PHP object injection vulnerability. The upgrade can typically be performed through the WordPress theme management interface or by downloading the patched version from the official Rascals repository and manually replacing theme files. Until patching is possible in time-constrained environments, implement input validation and sanitization at the application level to reject suspicious serialized object patterns, enforce WordPress security hardening (disable file editing, restrict plugin/theme installation to trusted sources only), and monitor for exploitation attempts by logging and alerting on unusual PHP object instantiation patterns. See the Patchstack vulnerability database at https://patchstack.com/database/Wordpress/Theme/vex/vulnerability/wordpress-vex-theme-1-2-9-php-object-injection-vulnerability for detailed advisory information.