What is the CVSS score of CVE-2026-27083?

CVE-2026-27083 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Work Travel Company are affected by CVE-2026-27083?

CVE-2026-27083 presents critical security risk, a insecure deserialization vulnerability rated CVSS 9.8.

How to fix or mitigate CVE-2026-27083?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Restrict deserialization to trusted data sources and implement integrity checks.

Work Travel Company CVE-2026-27083

EUVD-2026-15793 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-5f7g-3ffv-vj72

Deserialization Work Travel Company

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15793

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in ThemeREX Work & Travel Company work-travel-company allows Object Injection.This issue affects Work & Travel Company: from n/a through <= 1.2.

AnalysisAI

A PHP Object Injection vulnerability exists in the ThemeREX Work & Travel Company WordPress theme through version 1.2, stemming from unsafe deserialization of untrusted data (CWE-502). An attacker can exploit this vulnerability to inject malicious objects into the application, potentially leading to remote code execution or arbitrary object manipulation depending on the gadget chains available in the WordPress environment. No CVSS score, EPSS data, or KEV status is currently available, and the vulnerability was identified and reported by Patchstack, though active exploitation status remains unclear.

Technical ContextAI

This vulnerability involves unsafe PHP object deserialization, a critical security flaw where user-controlled data is passed to PHP's unserialize() function without proper validation. The Work & Travel Company theme (CPE: cpe:2.3:a:themerex:work_&_travel_company:*:*:*:*:*:*:*:*) is affected through version 1.2. CWE-502 (Deserialization of Untrusted Data) describes the root cause: when PHP deserializes arbitrary serialized objects, an attacker can craft malicious payloads that instantiate and invoke methods on arbitrary classes available in the application or its dependencies. In WordPress environments, this is particularly dangerous because numerous plugins and themes include magic methods (__wakeup, __destruct, __toString) that can be chained together (gadget chains) to achieve arbitrary code execution. The vulnerability likely exists in theme configuration loading, session handling, or user input processing functions that accept serialized data.

RemediationAI

Update ThemeREX Work & Travel Company to the latest available version beyond 1.2 immediately. Check the official ThemeREX website or WordPress.org theme directory for the patched release and apply the update through the WordPress admin dashboard (Appearance > Themes > Updates). If an immediate update is unavailable, temporarily disable the theme and switch to a secure alternative until a patch is released. Organizations unable to patch immediately should implement Web Application Firewall (WAF) rules to detect and block suspicious serialized object patterns in request payloads, restrict administrative access to trusted IP ranges, and monitor PHP error logs for deserialization warnings. Consult the Patchstack advisory and any official ThemeREX security notices for version-specific patch details and timelines.