EUVD-2026-96476
GHSA-f886-vm49-g824
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to Tipsy endpoint
-
DeliveryInject serialized PHP object payload
-
ExploitTrigger unserialize() of attacker data
-
ExecutionInvoke POP gadget chain
-
ImpactExecute code or tamper with site
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching a Tipsy theme code path that deserializes attacker-supplied input via PHP unserialize() (CWE-502); per the CVSS vector it is remote (AV:N) and needs no authentication (PR:N) or user interaction (UI:N) against a site running Tipsy theme version 1.6 or earlier. The practical LIMITING factor is that PHP Object Injection yields meaningful impact (RCE, file manipulation, SQLi) only when an exploitable POP gadget chain is present and reachable in the theme, WordPress core, or an active plugin - absent such a chain, impact may be reduced to denial-of-service or none. Sites not running the Tipsy theme, or running a fixed version, are not affected. |
| Impact | All exploitability signals point to high severity: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with full C/I/A impact (9.8), and the CWE-502 deserialization class is consistent with Patchstack's 'Unauthenticated PHP Object Injection' label. However, the real-world risk of PHP Object Injection is conditional in a way the raw score can hide: actual code execution or file access typically requires a usable POP (property-oriented programming) gadget chain reachable in the theme, WordPress core, or an active plugin - the 9.8 assumes worst-case impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is NO evidence of active or widespread exploitation; the only source is a single Patchstack database entry. Net: this is a genuine high-priority patch for sites running Tipsy (unauthenticated + network + deserialization is a combination historically abused in WordPress), but the absence of EPSS/KEV/POC means it is currently a prudent-patch item rather than a confirmed emergency. Missing signals (EPSS, POC, confirmed gadget chain) should be verified before escalating. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a public Tipsy theme endpoint that passes attacker-controlled data into a PHP unserialize() call. If a suitable gadget (POP) chain is present in the theme, WordPress, or an installed plugin, the injected object triggers it, leading to outcomes such as arbitrary file write/delete, SQL injection, or remote code execution. No public exploit code was identified at time of analysis, and impact depends on the availability of a reachable gadget chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in the ThemeREX Tipsy WordPress theme through version 1.6 allows remote attackers to supply crafted serialized data that the theme passes to PHP unserialize(), potentially leading to remote code execution, file manipulation, or SQL injection where a usable POP gadget chain exists. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the flaw is network-reachable, low-complexity, and requires neither authentication nor user interaction, with full confidentiality, integrity, and availability impact (9.8). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation is constrained by the need for an exploitable gadget chain in the theme, WordPress core, or an active plugin.
RemediationAI
No vendor-released patch has been identified at time of analysis, so remediation should focus on eliminating exposure and reducing gadget-chain reachability. The most direct action is to remove or deactivate the Tipsy theme and replace it with a maintained theme, since the vulnerable code path is only reachable when the theme is present and active; the side effect is a change to the site's appearance and any theme-specific functionality. If the theme cannot be removed, keep WordPress core and every installed plugin updated to the latest versions to minimize available POP gadget chains, restrict theme and plugin file editing to trusted administrators, and consider a Web Application Firewall rule that blocks serialized object payloads targeting affected endpoints, recognizing that this may cause false positives on legitimate serialized data used by some plugins. Monitor the Patchstack advisory at https://patchstack.com/database/wordpress/theme/tipsy/vulnerability/wordpress-tipsy-theme-1-6-php-object-injection-vulnerability?_s_id=cve for a fixed release and apply it as soon as it becomes available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The underlying issue is CWE-502, deserialization of untrusted data, within the Tipsy WordPress theme (vendor: ThemeREX; CPE: cpe:2.3:a:themerex:tipsy:*:*:*:*:*:*:*:*). The theme reaches a PHP unserialize() call on attacker-supplied input without sufficient validation, which permits PHP Object Injection: an attacker controls the serialized payload and thereby the class/object graph that PHP instantiates. Direct impact from object injection is typically limited to what the magic methods (__wakeup, __destruct, __toString, etc.) of instantiated classes do; meaningful RCE, SQL injection, or file operations require an exploitable POP gadget chain that is present and reachable in the theme, WordPress core, or an installed plugin. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the vulnerable code path is reachable remotely with no authentication or user interaction against sites running the affected theme version. PHP, WordPress, and the theme's deserialization pattern are the core technologies involved, as reflected in the source tags (PHP, WordPress, Deserialization, Tipsy, WordPress Theme) and the reporting by Patchstack.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Patchstack confirms unauthenticated (PR:N), network-reachable (AV:N) object injection; worst-case gadget chain justifies full C/I/A:H, though real impact is gadget-dependent.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
Executive ViewAI
The ThemeREX Tipsy WordPress theme, used on public-facing websites through version 1.6, contains a critical unauthenticated PHP object injection flaw that could allow an attacker to execute code or manipulate data on affected sites without logging in. Any organization hosting a WordPress site with this theme is exposed, and successful exploitation could hand an outside attacker full control of the web server and its underlying data. Because no vendor patch is currently available, leadership should treat this as an active exposure requiring immediate compensating action rather than a routine update cycle item.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or fully remove the ThemeREX Tipsy theme (version 1.6 and earlier) from all WordPress installations and replace it with a maintained alternative; if removal is not operationally feasible, apply WAF or virtual patching rules to block crafted serialized PHP object payloads reaching theme-related request paths; restrict administrative and network access to affected hosts where possible; and monitor webserver and application logs for suspicious serialized input, unexpected file writes, or database anomalies. Note that a public exploit has not been identified at time of analysis and exploitation depends on the presence of a usable POP gadget chain in the theme, WordPress core, or an active plugin, so reducing installed plugins and keeping core updated lowers practical risk while awaiting a vendor fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB