EUVD-2026-53989
GHSA-98qj-xx3j-73qx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization sink (AV:N/PR:N/UI:N/AC:L); object injection can yield full C/I/A impact via gadget chains, consistent with the reported 9.8.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.
AnalysisAI
Unauthenticated PHP Object Injection in the 69 Clothing WordPress theme (versions up to and including 1.2.11.1) lets remote attackers submit crafted serialized data that is unsafely deserialized, potentially triggering property-oriented programming (POP) gadget chains for code execution, data theft, or file manipulation. Reported by Patchstack and tracked as EUVD-2026-53989, it carries a critical CVSS 9.8 with no authentication required. There is no public exploit identified at time of analysis, but the network-reachable, unauthenticated nature makes it a high-priority patching target for any WordPress site running this theme.
Technical ContextAI
The vulnerability is a CWE-502 Deserialization of Untrusted Data flaw affecting the axiomthemes '69 Clothing' commercial WordPress theme (CPE cpe:2.3:a:axiomthemes:69_clothing). PHP Object Injection occurs when attacker-controlled input reaches PHP's unserialize() function; the attacker can instantiate arbitrary PHP objects whose magic methods (__wakeup, __destruct, __toString) fire automatically. When a suitable POP gadget chain exists in the theme, its bundled plugins, or the broader WordPress core/plugin ecosystem loaded alongside it, this can escalate to arbitrary file writes/deletes, SQL injection, or remote code execution. The 'Deserialization/PHP' tags confirm the mechanism, and the unauthenticated vector implies the vulnerable unserialize sink is reachable through a public request handler (e.g., an AJAX action or unauthenticated form/import endpoint) exposed by the theme.
RemediationAI
The input does not include a confirmed fixed version, so no vendor-released patch version can be cited - no vendor-released patch identified at time of analysis; monitor the Patchstack advisory (https://patchstack.com/database/wordpress/theme/clothing69/vulnerability/wordpress-69-clothing-theme-1-2-11-1-php-object-injection-vulnerability) and the axiomthemes/ThemeForest changelog for a release above 1.2.11.1 and upgrade as soon as it is available. Until a patched version ships, apply compensating controls: deploy a WAF/virtual patch (Patchstack offers one) to block requests containing PHP serialized-object payloads (patterns like 'O:' and 'a:' in POST bodies) reaching the theme's endpoints; identify and restrict or disable the unauthenticated theme endpoint that performs deserialization (for example the specific admin-ajax action or import/form handler), accepting that this may break the associated theme feature; and consider temporarily switching to a different theme on high-value sites, understanding this changes site appearance. Also audit installed plugins to reduce available POP gadget chains, since removing gadget sources lowers exploitability even before a patch.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today