EUVD-2026-96489
GHSA-2r74-fq56-39x6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public Avala theme endpoint
-
DeliverySend crafted serialized PHP object
-
ExploitTrigger unserialize() object injection
-
ExecutionInvoke POP gadget chain magic methods
-
ImpactAchieve file write or code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected component is the Avala WordPress theme (boldthemes) at versions 1.1.4 and earlier; a vulnerable, publicly reachable code path must pass attacker-controlled data to PHP unserialize(). Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required. The key LIMITING factor intrinsic to PHP Object Injection: meaningful impact (RCE, arbitrary file read/write/delete, SQLi) requires a usable POP/gadget chain present in the theme, WordPress core, or another installed plugin - without such a chain the injection may be inert. Exploitation also requires the Avala theme to be installed and active at <= 1.1.4. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a fully remote, unauthenticated, low-complexity flaw with high confidentiality, integrity, and availability impact - a worst-case profile on paper. The CWE-502 (deserialization) root cause and the 'Unauthenticated PHP Object Injection' description are mutually consistent, and PR:N aligns with the 'Unauthenticated' label. However, several real-world risk signals are MISSING from the input: no EPSS exploitation-probability score is provided, CISA KEV status is not supplied (treated as not listed), and no POC/exploit-code reference is present. Per precision rules this is 'no public exploit identified at time of analysis.' A critical caveat for PHP Object Injection specifically: the 9.8 rating assumes a usable POP/gadget chain is reachable in the theme, bundled libraries, WordPress core, or a co-installed plugin - without such a chain the practical impact can be far lower than C:H/I:H/A:H suggests, so the raw CVSS likely overstates guaranteed impact. Net assessment: a genuine high-priority patching item because it is unauthenticated and network-reachable, but absent EPSS/KEV/POC data there is no evidence of active or widespread exploitation yet, so treat it as 'patch promptly' rather than 'emergency in-the-wild' pending Patchstack/vendor confirmation of a working exploitation path. |
| Exploit ScenarioDerived | An unauthenticated remote attacker submits a crafted serialized PHP object to an Avala theme endpoint that passes attacker-controlled input to unserialize(). If a suitable POP gadget chain is present in the theme, WordPress, or an installed plugin, the injected object triggers magic-method side effects that can lead to file operations, SQL interaction, or code execution. No public exploit code was identified in the provided data, and successful impact depends on a reachable gadget chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in the BoldThemes Avala WordPress theme at version 1.1.4 and earlier lets remote attackers pass attacker-controlled data into PHP's unserialize() through a publicly reachable code path, with no authentication or user interaction required (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Real-world impact - remote code execution, arbitrary file read/write/delete, or SQL injection - depends on the presence of a usable POP/gadget chain in the theme itself, WordPress core, or another installed plugin; without such a chain the injection may be inert, so the 9.8 score represents a worst-case profile rather than a guaranteed outcome. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation requires the Avala theme to be installed and active at version 1.1.4 or below.
RemediationAI
No vendor-released patch was identified at time of analysis: the only reference supplied is the Patchstack advisory (https://patchstack.com/database/wordpress/theme/avala/vulnerability/wordpress-avala-theme-1-1-4-php-object-injection-vulnerability?_s_id=cve), and no fixed Avala version is specified, so administrators should monitor Patchstack and the BoldThemes vendor channel for a corrected release and apply it as soon as it ships. Until then, the most reliable compensating control is to deactivate and remove the Avala theme from any site where it is not strictly required - the trade-off being immediate loss of the site's theme layout and styling. If the theme must stay active, place a web application firewall or reverse proxy rule in front of the site to reject requests whose parameters or bodies contain serialized PHP object markers such as 'O:' followed by a digit and ':"', and restrict or monitor the specific theme endpoints that pass data to unserialize(); note that pattern-based blocking can be evaded by encoding and may cause false positives on legitimate serialized data. Because successful PHP object injection chaining depends on other installed code, reducing the gadget surface - removing unused plugins and keeping WordPress core and all plugins current - materially lowers the chance the injection becomes exploitable, though it does not remove the underlying sink.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic PHP Object Injection (CWE-502, Deserialization of Untrusted Data) in a WordPress theme distributed by BoldThemes and tracked under CPE cpe:2.3:a:boldthemes:avala:*. In PHP, unserialize() on attacker-supplied input reconstructs arbitrary objects and triggers their magic methods (__wakeup, __destruct, __toString, __call), which an attacker can chain into a property-oriented programming (POP) gadget chain. The security consequence is therefore conditional: the injection itself is unauthenticated and network-reachable per the assessed vector (PR:N/UI:N), but converting it into RCE, file disclosure, file deletion, or SQLi requires a gadget chain to already exist in the loaded codebase - the theme, WordPress core, or a co-installed plugin. This dual nature (trivially triggerable input, conditional payoff) is intrinsic to PHP object injection and explains why vendor databases score such issues at maximum impact while practical exploitability varies by site.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable unserialize() gives AV:N/AC:L/PR:N/UI:N; a reachable POP chain yields full C:H/I:H/A:H, though AC:H would apply if no gadget chain is available.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.
Executive ViewAI
The BoldThemes Avala WordPress theme (version 1.1.4 and earlier) poses a critical risk to organizations with public-facing websites, as an unauthenticated attacker could potentially compromise site integrity and data. No public exploit identified at time of analysis, and with no vendor-released patch identified at time of analysis, affected organizations must act quickly to mitigate exposure, as a successful exploit could lead to data breaches, reputational damage, and operational disruption.
Disable or remove the Avala theme if not essential; deploy WAF rules to block PHP object injection attempts; restrict public access to vulnerable code paths; monitor logs for suspicious activity; migrate to a secure alternative theme.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB