EUVD-2026-43383Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running 777 theme <= 1.13.0
-
DeliveryCraft malicious serialized PHP object
-
ExploitSend payload to vulnerable unserialize endpoint
-
ExecutionTrigger POP gadget chain via magic methods
-
PersistAchieve file write or code execution
-
ImpactCompromise WordPress site
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a request reaching the theme code path that deserializes untrusted input via unserialize() in the '777' theme (versions <= 1.13.0), and - critically - a usable PHP POP gadget chain present in the theme, WordPress core, or an installed plugin to convert object injection into concrete impact. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required, so exploitation targets network-reachable installations of the affected theme. The principal limiting factor is gadget-chain availability: without a reachable chain, the injected objects may have no exploitable effect, which constrains real-world impact despite the 9.8 score. The theme must be installed and active for the vulnerable code to be reachable. |
| Impact | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical) indicates a low-complexity, remote, unauthenticated path with full confidentiality, integrity, and availability impact. However, the practical severity of a PHP object injection flaw hinges on whether an exploitable gadget chain exists in the target deployment - object injection without a reachable POP chain may yield limited impact, which is a common reason real-world exploitability is lower than the 9.8 headline. No EPSS score, KEV entry, POC, or SSVC data was provided; absent those, the 9.8 should be treated as a worst-case ceiling rather than a confirmed automatable exploit. The Patchstack sourcing lends credibility to the finding, but the gap between the maximal CVSS and the missing exploitation evidence should be noted when prioritizing. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request containing a malicious serialized PHP object to a theme endpoint that calls unserialize() on the input. If a POP gadget chain is available in the theme, WordPress core, or an active plugin, the injected object's magic methods trigger during deserialization, leading to actions such as arbitrary file write, data disclosure, or code execution. No public exploit is identified at time of analysis, so an attacker would need to develop a working gadget chain for the target environment. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 13, 2026
Remote PHP object injection in the axiomthemes '777' (triple-seven) WordPress theme allows attackers to instantiate arbitrary PHP objects by supplying crafted serialized data to a vulnerable unserialize() call, affecting all versions up to and including 1.13.0. With the reported CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8, an unauthenticated network attacker can achieve high-impact compromise if a usable POP gadget chain is present. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified in the available data; the input only specifies affected versions through <= 1.13.0. Review the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/triple-seven/vulnerability/wordpress-777-theme-1-13-0-php-object-injection-vulnerability) for the vendor-supplied fixed release and upgrade to it once confirmed. Until a patched version is verified, apply compensating controls: deploy a WAF or Patchstack virtual patch to block serialized-object payloads (strings containing patterns like 'O:' or 'a:') to theme endpoints; restrict or disable the specific theme functionality that consumes serialized input if identifiable; and consider switching to an alternative theme on high-value sites, accepting the trade-off of layout/feature changes. Note that WAF rules on serialized data can produce false positives against legitimate serialized traffic and are not a substitute for the official fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the '777' premium WordPress theme by axiomthemes (CPE cpe:2.3:a:axiomthemes:777). The root cause is CWE-502, Deserialization of Untrusted Data: the theme passes attacker-influenced input into PHP's unserialize() without validating or restricting the object types produced. In WordPress themes this typically arises from unserializing request parameters, cookies, transients, or option values. The security impact of object injection depends on the availability of 'POP' (Property-Oriented Programming) gadget chains within the theme, WordPress core, or active plugins - magic methods such as __wakeup() or __destruct() can be abused to escalate object injection into file operations, SQL access, or code execution.
Know when 777 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated (AV:N/PR:N/UI:N), but AC:H because reliable impact requires a usable POP gadget chain; full C/I/A impact assumed when a chain exists.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through <= 1.13.0.
Executive ViewAI
The axiomthemes '777' WordPress theme (versions up to 1.13.0) contains a critical remote vulnerability (CVSS 9.8) that permits unauthenticated attackers to take over affected WordPress websites without any user interaction. Any organization using this theme faces immediate risk of website compromise, data theft, and malware installation. No vendor patch currently exists, requiring urgent workaround implementation.
Immediately disable and remove the axiomthemes '777' theme from all WordPress installations, replacing it with a vetted alternative theme; deploy Web Application Firewall rules to detect and block serialized PHP object payloads in web requests; monitor WordPress and PHP error logs in real-time for object instantiation exploit attempts; configure server-side PHP restrictions to limit dynamic object instantiation where possible; audit and update all installed WordPress plugins to identify and patch those containing exploitable PHP object gadget chains; once axiomthemes releases a patched version, apply immediately and verify remediation through security testing before re-enabling.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
GitHub PoC
Exploit-DB