Avventure WordPress Theme CVE-2026-62010

The target must be a WordPress installation running the Avventure theme at version 1.1.12 or earlier (vendor themerex). Exploitation requires reaching an input that the theme passes to PHP unserialize() with attacker-controlled data; the specific feature, parameter, or endpoint acting as the sink is not described in the available sources. Reaching full code execution further requires a usable gadget chain present in the theme, WordPress core, or an installed plugin - a limiting factor the advisory does not confirm. Per CVSS (PR:N/UI:N) no authentication or user interaction is required, and it applies to default installations of the vulnerable theme.

All signals point in the same direction for severity: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity flaw needing no privileges or user interaction, with high confidentiality, integrity and availability impact (9.8 Critical), and the vuln.today Decision label is act_now. CWE-502 PHP Object Injection in a WordPress theme typically allows an attacker to feed a crafted serialized payload that, combined with a usable gadget chain in the theme or the broader WordPress/plugin stack, can escalate to file operations or remote code execution - consistent with the C:H/I:H/A:H rating. However, several real-risk signals are MISSING from the input: there is no EPSS exploitation-probability score, the CVE is NOT listed in CISA KEV, and no working exploit code is supplied (the sole reference is a Patchstack advisory). So this is a high-CVSS issue with a confirmed-critical mechanism but no evidence of active or widespread exploitation yet. Priority should follow the act_now label and the unauthenticated network vector, tempered by the fact that real-world object-injection RCE depends on a reachable gadget chain the advisory does not confirm - exploitability in a given install is therefore likely but unverified from the available data.

A remote, unauthenticated attacker sends a crafted request to a WordPress site running the Avventure theme (<= 1.1.12), placing an attacker-controlled serialized PHP object into an input the theme deserializes. If a suitable gadget chain exists in the theme, WordPress core, or an installed plugin, the injected object triggers unintended method calls leading to file read/write, data tampering, or code execution. No public exploit code is provided in the available sources, and the exact gadget chain is not described, so practical impact depends on the target's installed components.