EUVD-2026-112950
GHSA-x6hf-v9hx-4p8f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress site running Printy
-
DeliverySend crafted serialized PHP payload
-
ExploitTrigger unsafe deserialization (CWE-502)
-
ExecutionInvoke POP gadget chain
-
ImpactAchieve code execution or data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target WordPress site runs the Printy theme at version 1.13.0 or earlier and that attacker-controlled serialized data reaches a PHP deserialization point in the theme. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is needed, so default installations are reachable remotely. The practical limiting factor is the availability of a usable POP gadget chain in the theme or a co-installed plugin - PHP Object Injection yields real impact (RCE, file write, data disclosure) only when such a chain is present; without it, impact may be limited. The specific vulnerable parameter and trigger are not described in the available sources. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a remotely reachable, low-complexity flaw requiring no privileges and no user interaction, with full confidentiality, integrity and availability impact - the maximum-severity profile for a web application bug. The vuln.today Decision label is act_now, and the issue is CWE-502 (deserialization / PHP Object Injection), a class that can escalate to remote code execution when a suitable gadget chain is present in the theme or any co-installed plugin. However, several key real-world signals are MISSING: no EPSS score was provided, the CVE is not listed in CISA KEV, and no working exploit code is referenced - only a Patchstack database advisory. The practical impact of a PHP Object Injection bug is contingent on the availability of a usable POP gadget chain, which the available evidence does not confirm; CVSS rates the worst-case assumption rather than a demonstrated outcome. Net: the severity rating is justified as a worst case and the act_now label warrants prompt patching, but in the absence of EPSS, KEV, and a verified exploit this is better characterized as high-potential-impact-pending-gadget-availability than as confirmed widespread exploitation. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to a Printy-powered WordPress site carrying a malicious serialized PHP payload to a parameter that is deserialized by the theme. If a suitable POP gadget chain exists in the theme or any installed plugin, deserialization triggers that chain, potentially leading to file operations, data disclosure, or remote code execution. No public working exploit code is referenced in the available data; only a Patchstack advisory exists, and the specific trigger parameter is not described in the sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
Unauthenticated PHP object injection in the Printy WordPress theme through version 1.13.0 lets remote attackers supply serialized data to a PHP deserialization point without credentials or user interaction, carrying a CVSS 9.8 rating and an act_now priority. The supplied intelligence does not identify active exploitation (no CISA KEV entry) or public exploit code, and real-world impact depends on whether a usable POP gadget chain exists in Printy or a co-installed plugin because the vulnerable parameter and trigger are not described. Sites running Printy 1.13.0 or earlier should be treated as exposed until a fixed release is confirmed.
RemediationAI
The supplied intelligence does not identify a vendor-released patch or a fixed version for Printy. Until a patched release is confirmed, deactivate and remove the Printy theme from any WordPress site that does not require it; this eliminates the theme's deserialization surface but changes the site's front-end design and requires switching to a maintained theme. Because the vulnerable parameter and trigger are not described, no specific endpoint, parameter or theme feature can be safely disabled as a targeted workaround, and the evidence does not provide a reliable partial mitigation for sites that must keep the theme active. Track the Patchstack advisory at https://patchstack.com/database/wordpress/theme/printy/vulnerability/wordpress-printy-theme-1-13-0-php-object-injection-vulnerability?_s_id=cve for a fixed release and re-enable the theme only after a corrected version is confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-502 (Deserialization of Untrusted Data) in a WordPress theme context means attacker-controlled serialized input reaches an unsafe PHP deserialization operation such as unserialize(), which can allow manipulation of PHP object properties and magic-method invocation. The CPE cpe:2.3:a:themerex:printy:*:*:*:*:*:*:*:* identifies the Themerex Printy theme package, and the description bounds affected releases at 1.13.0 or earlier. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates network reachability, low complexity, no privileges and no user interaction, but the supplied sources do not specify which theme parameter, hook, endpoint or feature reaches the deserialization sink. Exploitability beyond the injection itself depends on a POP gadget chain being available in the theme or another installed plugin; without such a chain the practical effect may be limited, and the sources do not confirm a usable chain. No KEV status, EPSS score or public exploit reference is present in the supplied intelligence.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated, network-reachable PHP Object Injection with no user interaction; worst-case assumes a reachable gadget chain yielding full C/I/A impact, consistent with the reported 9.8.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.
Executive ViewAI
The Printy WordPress theme, used across affected sites through version 1.13.0, contains a critical unauthenticated PHP object injection flaw that could let remote attackers compromise site integrity without any credentials or user interaction. Because WordPress sites frequently host customer data, transactions, and brand-facing content, leadership should treat every site running this theme as a potential entry point until a fixed release is confirmed and deployed.
No vendor-released patch identified at time of analysis. Interim mitigations include WAF or virtual patching rules against PHP object injection, restricting access to affected sites, reducing exposure by removing or replacing the Printy theme, and auditing co-installed plugins for exploitable gadget chains.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB