Skip to main content

Traveler CVE-2026-25449

| EUVD-2026-12821 CRITICAL
Deserialization of Untrusted Data (CWE-502)
2026-03-18 Patchstack
Deserialization Traveler
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Re-analysis Queued
Apr 23, 2026 - 16:12 vuln.today
cvss_changed
Analysis Updated
Apr 16, 2026 - 05:50 EUVD-patch-fix
executive_summary
Re-analysis Queued
Apr 16, 2026 - 05:29 backfill_euvd_patch
patch_released
Patch available
Apr 16, 2026 - 05:29 EUVD
3.2.8.1
EUVD ID Assigned
Mar 18, 2026 - 13:45 euvd
EUVD-2026-12821
Analysis Generated
Mar 18, 2026 - 13:45 vuln.today
CVE Published
Mar 18, 2026 - 13:12 nvd
CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Shinetheme Traveler allows Object Injection.This issue affects Traveler: from n/a before 3.2.8.1.

AnalysisAI

A critical PHP object injection vulnerability exists in the Shinetheme Traveler WordPress theme due to insecure deserialization of untrusted data. This affects all versions prior to 3.2.8.1 and allows unauthenticated remote attackers to execute arbitrary code, compromise data confidentiality and integrity, and cause denial of service. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send malicious serialized object to Traveler endpoint
Exploit
Trigger unsafe deserialization in vulnerable version
Execution
Inject arbitrary PHP object
Impact
Execute remote code as web server user
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Remote unauthenticated attacker can exploit default Shinetheme Traveler installations before version 3.2.8.1 by sending crafted serialized objects over the network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This represents a critical real-world risk based on multiple indicators. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated remote attacker identifies a WordPress site running the vulnerable Traveler theme through version fingerprinting or reconnaissance. The attacker crafts a malicious serialized PHP object containing a POP chain that leverages available classes in the WordPress environment to achieve remote code execution. …
Remediation Immediately upgrade the Shinetheme Traveler theme to version 3.2.8.1 or later, which addresses the insecure deserialization vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all WordPress installations using Shinetheme Traveler theme and document current versions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

CVE-2026-25449 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy