What is the CVSS score of CVE-2026-27084?

CVE-2026-27084 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Buisson are affected by CVE-2026-27084?

Organizations using Deserialization of Untrusted Data vulnerability in ThemeREX Buisson buisson face critical risk from CVE-2026-27084, a insecure deserialization vulnerability rated CVSS 9.8.

How to fix or mitigate CVE-2026-27084?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Restrict deserialization to trusted data sources and implement integrity checks.

Buisson CVE-2026-27084

EUVD-2026-15796 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-qq9h-65hg-3824

Deserialization Buisson

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15796

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in ThemeREX Buisson buisson allows Object Injection.This issue affects Buisson: from n/a through <= 1.1.11.

AnalysisAI

A PHP Object Injection vulnerability exists in the ThemeREX Buisson WordPress theme through version 1.1.11, stemming from unsafe deserialization of untrusted data (CWE-502). This flaw allows attackers to inject malicious serialized objects that can lead to arbitrary code execution or other object manipulation attacks depending on available gadget chains in the WordPress environment. While no CVSS score or EPSS data is currently published and the vulnerability has not been listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, the public disclosure via Patchstack indicates active awareness in the security community.

Technical ContextAI

The vulnerability arises from unsafe PHP object deserialization, where user-controlled input is passed to PHP's unserialize() function without proper validation or sanitization. ThemeREX Buisson (CPE: cpe:2.3:a:themerex:buisson:*:*:*:*:*:*:*:*), a WordPress theme, implements deserialization logic that fails to restrict object instantiation, violating the principle that untrusted data should never be deserialized. CWE-502 (Deserialization of Untrusted Data) is the root cause classification. When an attacker supplies malicious serialized PHP objects, the unserialize() function reconstructs those objects in memory, potentially triggering magic methods (__wakeup, __destruct, __toString) on gadget chain classes available in WordPress or installed plugins, leading to code execution or information disclosure.

RemediationAI

Users of the ThemeREX Buisson theme should upgrade to the latest patched version immediately (version 1.1.12 or later, once released by the vendor). Until an official patch is available, WordPress administrators should verify the patch status via Patchstack's database and the official ThemeREX repository. As a temporary mitigation, consider disabling the theme if not actively in use, restricting administrative access to trusted users only, and implementing Web Application Firewall (WAF) rules to block requests containing suspicious serialized PHP object patterns (detection of 'O:' followed by class names). Additionally, conduct an audit of installed WordPress plugins to identify and remove any with known gadget chains (such as older versions of popular plugins). Monitor for updates from the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/buisson/vulnerability/wordpress-buisson-theme-1-1-11-php-object-injection-vulnerability.