EUVD-2026-112979
GHSA-v35g-pjfq-8qfw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach vulnerable theme endpoint
-
DeliverySubmit serialized PHP object payload
-
ExploitTrigger unsafe deserialization (CWE-502)
-
ExecutionInvoke reachable gadget chain
-
ImpactCompromise site (C/I/A impact)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target WordPress site to have the ThemeREX Gamic theme version 1.19 or earlier installed and active, and to reach the specific deserialization sink in that theme with attacker-controlled serialized input. Per the CVSS vector (PR:N/UI:N) the flaw is unauthenticated with no user interaction. A key limiting factor the sources do not resolve: full code-execution impact depends on a usable PHP property-oriented gadget chain being present and reachable in the theme, plugins, or WordPress core - the available evidence does not confirm which gadget or sink is involved. The specific parameter/endpoint that deserializes input is not described in the available sources. |
| Impact | Signals mostly align toward high priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with full confidentiality/integrity/availability impact, and the vuln.today Decision label is act_now. CWE-502 PHP Object Injection reaching unauthenticated users is a serious class because a usable gadget chain commonly escalates to code execution. However, several real-world-risk signals are absent rather than reassuring: no EPSS probability is provided, the vulnerability is not listed in CISA KEV, and no verified working exploit is referenced - the single Patchstack entry is an advisory, not exploit code. The impact ceiling (C:H/I:H/A:H) is contingent on a suitable PHP gadget chain being present in the theme or its loaded plugins/core; the available sources do not describe the trigger or confirm a reachable gadget, so the maximum impact is plausible but not demonstrated. Net: treat as a genuine act_now priority for anyone running the Gamic theme, while recognizing the high score reflects potential rather than observed mass exploitation. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to a WordPress site running the Gamic theme (<= 1.19) containing a serialized PHP object in a parameter the theme deserializes. If a property-oriented gadget chain is reachable, deserialization triggers it, potentially leading to code execution, data disclosure, or site compromise. No public exploit identified at time of analysis; the trigger is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
Unauthenticated PHP object injection in the ThemeREX Gamic WordPress theme through version 1.19 lets remote attackers supply crafted serialized input to a deserialization sink, and the CVSS 9.8 vector indicates high confidentiality, integrity, and availability impact. The vulnerability class is CWE-502; full code-execution impact depends on a usable PHP gadget chain, and the specific vulnerable parameter or endpoint is not described in the available sources. The provided intelligence has no CISA KEV listing or public exploit identified at time of analysis, while the vuln.today decision label is act_now.
RemediationAI
No vendor-released fixed Gamic version is identified in the provided data, so patch status is not independently confirmed; check the Patchstack advisory for the current fixed release and apply it when published. Given the act_now decision signal, prioritize affected sites; until a vendor fix is available, deactivate and remove the vulnerable Gamic theme and migrate to a maintained alternative theme, which eliminates the theme's deserialization sink. If the theme must remain installed, reduce exposure by taking theme-dependent functionality offline or placing access restrictions in front of the site as compensating controls, recognizing that these measures do not correct the underlying CWE-502 flaw. Because the exact vulnerable endpoint is not described, targeted virtual patching cannot be specified from the available evidence. Advisory: https://patchstack.com/database/wordpress/theme/gamic/vulnerability/wordpress-gamic-theme-1-19-php-object-injection-vulnerability?_s_id=cve.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress theme, ThemeREX Gamic, identified by CPE cpe:2.3:a:themerex:gamic:*:*:*:*:*:*:*:* and reported for versions up to and including 1.19. CWE-502 covers deserialization of untrusted data, here described as PHP object injection: attacker-controlled serialized input reaches a PHP deserialization operation, which can instantiate objects and invoke magic methods. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms a network-reachable, unauthenticated attack with no user interaction and high impact, but the sources do not identify the deserialization sink, the request parameter, or the gadget chain required for code execution. Consequently, the trigger and the conditions that turn object injection into concrete code execution remain unverified in the supplied evidence.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated, network-reachable PHP object injection with no user interaction (AV:N/AC:L/PR:N/UI:N); C/I/A set High reflecting the typical full-compromise ceiling of exploitable deserialization, though contingent on a reachable gadget chain.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.
Executive ViewAI
A critical vulnerability in the ThemeREX Gamic WordPress theme (through version 1.19) allows unauthenticated attackers to inject serialized data that can lead to arbitrary code execution on affected sites. Any organization hosting web properties built on this theme faces potential full compromise of confidentiality, integrity, and availability, making this a priority for leadership given how widely WordPress themes are deployed across public-facing marketing and content sites.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or remove the vulnerable theme, deploy WAF rules blocking crafted serialized input, restrict and monitor theme endpoints, and accelerate migration to a maintained alternative theme.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB