Drone Media CVE-2026-66482

Exploitation requires reaching the Drone Media theme's vulnerable deserialization sink with attacker-controlled serialized input; per CVSS PR:N/UI:N this is unauthenticated and needs no user interaction against a default install running the theme at version <= 2.2.0. The practical limiting factor is the availability of a usable POP (property-oriented programming) gadget chain in the theme, WordPress core, or an active plugin - PHP Object Injection only achieves the full C:H/I:H/A:H impact when such a chain exists to turn the injected object into code execution or file operations; without one, impact may be reduced. The theme must be installed and active, and the specific injectable endpoint/parameter must be network-reachable (not restricted by WAF or authentication front-end).

All CVSS base metrics point to maximum severity: AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact yields the 9.8 critical score, meaning a remote, unauthenticated attacker can reach the vulnerable code path over the network with low complexity and no user interaction. The CWE-502 deserialization flaw (PHP Object Injection) is a classic high-impact class that typically leads to arbitrary code execution or file operations WHEN a usable POP gadget chain exists in the theme, WordPress core, or active plugins - the raw C:H/I:H/A:H rating assumes such a chain is reachable, which is common but not guaranteed for every installation. Countervailing signals strongly temper real-world prioritization: there is no EPSS score provided, no CISA KEV listing, and no public proof-of-concept referenced, so there is no evidence of active or imminent exploitation - the risk is theoretical-but-serious rather than confirmed-active. EPSS data is entirely absent from the input, so exploitation probability cannot be quantified; do NOT treat the 9.8 as a proxy for likelihood. Net: patch promptly because the vector is unauthenticated and critical, but this is a high-CVSS issue without (yet) the exploitation-maturity signals that would make it an emergency.

A remote, unauthenticated attacker submits a crafted request containing a malicious serialized PHP object to an endpoint exposed by the Drone Media theme (<= 2.2.0), triggering unsafe deserialization. If a suitable POP gadget chain is present in the theme, WordPress core, or an installed plugin, the injected object properties drive dangerous operations such as file writes, deletion, or code execution during object destruction. No public exploit code was identified at the time of analysis, so weaponization would currently require the attacker to develop their own gadget chain.