EUVD-2026-96492
GHSA-fj7w-wv6h-73h9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach theme deserialization endpoint over HTTP
-
DeliverySubmit crafted serialized PHP object
-
ExploitTrigger PHP object injection (CWE-502)
-
ExecutionInvoke gadget chain on unserialize
-
ImpactExecute code / compromise site
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The site must run the ThemeRex 'Equadio' WordPress theme at version 1.1.4 or earlier, and reach an entry point that deserializes attacker-controlled input (PHP Object Injection). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required against such an install. The practical limiting factor is the presence of a usable POP gadget chain in the theme, installed plugins, or WordPress core - object injection alone is harmless without a reachable gadget - so impact varies by the specific plugin/library stack deployed alongside the theme. |
| Impact | All provided severity signals point in one direction: the NVD CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a remote, unauthenticated, low-complexity flaw with no user interaction and high impact to confidentiality, integrity and availability. CWE-502 (deserialization of untrusted data) combined with the 'PHP Object Injection' description is consistent with that vector, as object injection commonly yields code execution or arbitrary file operations when a usable gadget chain exists - explaining the uniform C:H/I:H/A:H. However, the actual real-world severity hinges on whether an exploitable POP (property-oriented programming) gadget chain is reachable in a default Equadio install or its bundled libraries; the Patchstack entry does not confirm one, so the 9.8 is a worst-case rating. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no signal of active or probable exploitation to corroborate the high CVSS. No SSVC decision data (exploitation/automatable/technical-impact) was provided. Net: this is a theoretically critical, easily-reachable vulnerability class, but with EPSS, KEV, and POC all absent and the affected product being a niche WordPress theme, it reads as a patch-promptly item rather than evidence of widespread active abuse - EPSS/KEV absence is a gap in the data, not proof of low risk. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to a WordPress site running the Equadio theme (<= 1.1.4), supplying a serialized PHP object to a parameter that is deserialized by vulnerable theme code. If a suitable gadget chain is present in the theme, plugins, or core, the injected object triggers unintended method calls on destruction/wakeup, potentially leading to remote code execution or arbitrary file manipulation. No public exploit code is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in the ThemeRex Equadio WordPress theme (versions up to and including 1.1.4) allows remote attackers to supply crafted serialized input to vulnerable deserialization entry points, potentially leading to remote code execution, file deletion, or other high-impact outcomes depending on available gadget chains. The flaw carries a CVSS 3.1 base score of 9.8, reflecting network exploitability with low complexity, no authentication, and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, though the severity and ease of exploitation make prompt patching critical.
RemediationAI
Upgrade the Equadio theme to a version newer than 1.1.4; the exact fixed version is not specified in the provided data, but the Patchstack advisory (https://patchstack.com/database/wordpress/theme/equadio/vulnerability/wordpress-equadio-theme-1-1-4-php-object-injection-vulnerability?_s_id=cve) should list the patched release. If an update cannot be applied immediately, temporarily switch to a default WordPress theme (e.g., Twenty Twenty-Four) to remove the vulnerable code path-this will alter the site's appearance. Alternatively, deploy a web application firewall (WAF) rule to detect and block serialized object payloads in request parameters, though determined attackers may bypass such filtering. Additionally, ensure all plugins and WordPress core are up to date to reduce the availability of gadget chains that could be used to escalate the object injection into code execution. Consult the advisory for official remediation guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PHP object injection is a vulnerability class (CWE-502: Deserialization of Untrusted Data) that occurs when untrusted input is passed to PHP's unserialize() function. In the ThemeRex Equadio WordPress theme, an unauthenticated attacker can supply a crafted serialized string to a vulnerable entry point, causing the theme to instantiate arbitrary PHP objects. While the object injection itself does not directly execute code, it can be leveraged through a POP (Property-Oriented Programming) gadget chain present in the theme, installed plugins, or WordPress core to achieve remote code execution, arbitrary file deletion, or other high-impact actions. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates exploitation is remote, low-complexity, unauthenticated, and requires no user interaction, with high impact to confidentiality, integrity, and availability. The affected product is identified by CPE cpe:2.3:a:themerex:equadio:*:*:*:*:*:*:*:* for versions up to and including 1.1.4.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote request with no user interaction (AV:N/AC:L/PR:N/UI:N); PHP object injection can yield full code/data compromise, so C:H/I:H/A:H, scope unchanged.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.
Executive ViewAI
A critical vulnerability in the ThemeRex Equadio WordPress theme (versions up to and including 1.1.4) could allow an outside attacker to run arbitrary code or destroy files on any internet-facing site using that theme, effectively handing over control of the site and anything it hosts or connects to. Because Equadio is a third-party theme and no vendor fix is currently available, every affected property - customer-facing sites, content, and any data or integrations they touch - stays exposed until we contain it ourselves. Leadership should treat this as both a brand-trust and data-integrity risk, not a routine plugin update.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the affected Equadio theme on all instances; apply WAF virtual patching that blocks serialized PHP object payloads in request parameters, headers, and POST bodies; restrict and monitor filesystem write access for the web server user; deploy file-integrity monitoring on theme and wp-content directories; review web, PHP, and authentication logs for exploitation attempts or post-exploitation artifacts; and replace the theme with a maintained alternative if no fix is published.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB