EUVD-2026-37464Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable unserialize() sink with no user interaction; a reachable POP chain yields full RCE, justifying PR:N, AC:L and C:H/I:H/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions.
Articles & Coverage 1
AnalysisAI
Unauthenticated PHP Object Injection in BoldThemes Nifty WordPress theme versions 1.4.1 and earlier allows remote attackers to inject arbitrary PHP objects through unsafe deserialization, potentially leading to remote code execution when a suitable gadget chain exists in the WordPress installation. No public exploit identified at time of analysis, but the unauthenticated network-reachable nature combined with CVSS 9.8 makes this a high-priority issue for any site running the affected theme. Reported by Patchstack and tracked as EUVD-2026-37464.
Technical ContextAI
The vulnerability is a CWE-502 Deserialization of Untrusted Data flaw in the Nifty commercial WordPress theme published by BoldThemes (CPE cpe:2.3:a:boldthemes:nifty). PHP Object Injection occurs when user-controlled input is passed to PHP's unserialize() function, allowing attackers to instantiate arbitrary classes and trigger magic methods such as __wakeup, __destruct, or __toString. In WordPress contexts, this is typically exploitable via Property-Oriented Programming (POP) gadget chains present in WordPress core, bundled plugins, or other themes - common chains like Monolog, Guzzle, or Requests can lead to file writes, SSRF, or full remote code execution depending on the installed code base.
RemediationAI
No vendor-released patch identified at time of analysis; the EUVD entry lists the affected range as '≤1.4.1' without naming a fixed version, so administrators should monitor the BoldThemes vendor channel and the Patchstack advisory at https://patchstack.com/database/wordpress/theme/nifty/vulnerability/wordpress-nifty-theme-1-4-1-php-object-injection-vulnerability for a fixed release and upgrade as soon as one is published. In the interim, deploy a WordPress WAF such as Patchstack or Wordfence with virtual patching enabled to block crafted serialized payloads (trade-off: WAF rules can be bypassed by encoding tricks and add request-processing overhead), audit the theme's PHP files for calls to unserialize() on request data ($_GET, $_POST, $_COOKIE, $_REQUEST) and consider replacing them with json_decode() or hot-patching the affected endpoints (trade-off: invalidates vendor support and may break theme features), restrict access to vulnerable theme endpoints via webserver ACLs where they are not needed by site visitors, and remove unused plugins to shrink the available POP gadget surface. If the site does not strictly require the Nifty theme, switching to a maintained theme is the safest option.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today