EUVD-2026-96478
GHSA-w74p-39xg-c686
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to theme endpoint
-
DeliveryDeliver malicious serialized PHP object
-
ExploitTrigger unsafe deserialization (CWE-502)
-
ExecutionInvoke gadget chain for code execution
-
ImpactFull compromise of WordPress site
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be a WordPress installation running the ThemeRex 'Yacht Rental' theme at version 2.6 or earlier. Exploitation requires reaching a code path that deserializes attacker-controlled input (CWE-502); per the CVSS vector it needs no authentication (PR:N), no user interaction (UI:N), and works against default configurations over the network. The practical limiting factor is the need for a usable PHP gadget chain in the theme, WordPress core, or installed plugins to escalate object injection to meaningful impact such as code execution - without a suitable gadget, impact may be reduced. Exposure is bounded to sites that have this specific theme installed and active. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely exploitable, unauthenticated, low-complexity flaw with high confidentiality, integrity, and availability impact, yielding a 9.8 base score - the theoretical worst case for a web vulnerability. CWE-502 (deserialization of untrusted data) leading to PHP Object Injection typically enables remote code execution when a suitable gadget chain is present in the theme or any installed plugin, which is consistent with the full C:H/I:H/A:H impact. However, the real-world signal set is thin: no EPSS probability was provided, the vulnerability is NOT on the CISA KEV list, and no public proof-of-concept is indicated (no public exploit identified at time of analysis). The sole intelligence source is the Patchstack advisory. This is a genuine high-priority issue for the specific population running the Yacht Rental theme because PR:N object injection is a favored, reliably weaponizable bug class, but the absence of KEV/EPSS/POC signals means there is no evidence of active or at-scale exploitation yet. Note also that practical exploitability of PHP Object Injection depends on the availability of a usable gadget chain in the deployed stack - a factor the CVSS score does not capture - so impact may range from information disclosure to full RCE depending on the environment. |
| Exploit ScenarioDerived | A remote attacker sends a crafted HTTP request to a WordPress site running the Yacht Rental theme (version 2.6 or earlier), supplying a malicious serialized PHP object to a parameter that is deserialized without validation. If a gadget chain exists in the theme, WordPress core, or an installed plugin, the injected object triggers unintended method calls that can lead to arbitrary file operations, SQL manipulation, or remote code execution. No authentication or user interaction is required; no public exploit code is currently identified, so exploitation would require the attacker to develop or adapt a gadget chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in the ThemeRex 'Yacht Rental' WordPress theme affects all versions up to and including 2.6, allowing a remote attacker to pass crafted serialized data into a PHP deserialization path without credentials or user interaction. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the theoretical worst case is high confidentiality, integrity, and availability impact with a 9.8 base score. No public exploit code has been identified at time of analysis, and the practical severity depends on whether a usable PHP gadget chain exists within the theme, WordPress core, or co-installed plugins - without such a gadget, real-world impact may be reduced.
RemediationAI
No vendor-released patch was identified at time of analysis, and no fixed version number should be assumed, so remediation must be compensatory until ThemeRex publishes an update. The most effective immediate step is to deactivate and remove the 'Yacht Rental' theme from any production WordPress installation (or, if it must remain for staging purposes, keep it inactive) and migrate to a maintained alternative - the trade-off is loss of the theme's layout and rental-specific functionality, requiring re-theming or a replacement plugin. If the theme cannot be removed, block or strip serialized payloads (strings matching /O:\d+:"/ or base64-encoded equivalents) reaching theme endpoints at the WAF or reverse proxy, accepting that this may break legitimate features that rely on serialized data and can be bypassed with encoding tricks. Additional hardening: restrict or disable theme AJAX/REST handlers not in active use, apply virtual patching rules offered by the reporting vendor Patchstack, keep WordPress core and all plugins updated to minimize available gadget chains, and monitor logs for suspicious requests carrying serialized object strings. Consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/yacht-rental/vulnerability/wordpress-yacht-rental-theme-2-6-php-object-injection-vulnerability?_s_id=cve) for any subsequent patch release before restoring the theme.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic PHP Object Injection (CWE-502, Deserialization of Untrusted Data) in the ThemeRex 'Yacht Rental' WordPress theme, tracked via CPE cpe:2.3:a:themerex:yacht_rental:*:*:*:*:*:*:*:* and reported by Patchstack. Root cause is the theme passing attacker-controlled input into PHP's unserialize() (or an equivalent object hydration routine) without adequate validation, allowing an attacker to instantiate arbitrary PHP objects and control their properties. The full exploitation chain typically requires a 'POP gadget chain' - a sequence of magic methods (__wakeup, __destruct, __toString, etc.) across theme, core, or plugin classes that turns object instantiation into a concrete primitive such as file deletion, file write, SQL injection, or remote code execution. Because WordPress themes execute in the same process as core and all active plugins, the available gadget surface is environment-dependent, which is why the assessed CVSS vector represents the theoretical maximum rather than a guaranteed outcome on every installation.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization (AV:N/PR:N/UI:N/AC:L); PHP Object Injection via gadget chain supports full C/I/A impact within the application scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.
Executive ViewAI
The ThemeRex 'Yacht Rental' WordPress theme, in all versions through 2.6, carries a critical unauthenticated flaw that could allow an attacker to seize control of any website running it without needing a login or any user action. Organizations in travel, hospitality, and charter-booking - where this theme is commonly deployed - risk full site takeover, exposure of customer booking and payment data, and loss of public trust if a usable code-execution path exists in their environment. Because the theme cannot currently be fixed by the vendor, the exposure persists until the site is changed or the theme is removed.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or deactivate the Yacht Rental theme entirely (strongest option, since it eliminates the vulnerable code path); take affected sites offline or place them behind an authenticated proxy; deploy WAF or reverse-proxy rules rejecting serialized PHP object payloads and suspicious encoded input; restrict wp-admin, REST API, and XML-RPC access by IP or require additional authentication; reduce the gadget-chain surface by removing unused plugins and keeping WordPress core and remaining plugins current; enable file-integrity monitoring, web-application logging, and alerting for anomalous PHP behavior; and monitor the ThemeRex vendor advisory channel for a fixed version.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB