EUVD-2026-96516
GHSA-4mc9-h8qv-hj9w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public WordPress endpoint
-
DeliverySend request with serialized PHP object
-
ExploitTrigger unserialize() of untrusted input
-
ExecutionInvoke POP gadget chain
-
ImpactExecute code or tamper with data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ThemeRex Education Center WordPress theme at version 3.6.12 or earlier to be installed and active, and reaching the specific theme code path that deserializes attacker-controlled input via unserialize(). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed and the attack is network-remote against default installations. The principal limiting factor is realized impact: PHP object injection only escalates to code execution or significant integrity/availability damage when a usable POP gadget chain exists within the theme, WordPress core, or co-installed plugins - so the full C:H/I:H/A:H outcome depends on the gadgets available in a given deployment. The narrow installed base of this specific commercial theme further limits exposure to sites that run it. |
| Impact | All available signals point to a genuinely high-priority flaw, though several corroborating data points are missing. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated vulnerability with full confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with the 9.8 Critical score and with CWE-502 (deserialization of untrusted data), which in PHP commonly escalates to remote code execution through POP gadget chains. However, the richer exploitation signals are absent: there is no EPSS probability, no CISA KEV listing, and no indication of public proof-of-concept code in the provided data, so there is currently no public exploit identified at time of analysis. The practical severity of PHP object injection is also gadget-dependent - impact requires a usable gadget chain in the theme or its loaded dependencies/plugins, which the single Patchstack reference does not detail; the C:H/I:H/A:H rating should therefore be read as the worst-case potential rather than a confirmed RCE. Net assessment: treat as a real priority for any site running the affected ThemeRex Education Center theme because it is unauthenticated and network-facing, but note the exploitation-likelihood signals (EPSS/KEV/POC) are unavailable rather than confirmed low. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker submits a crafted request to a WordPress site running the ThemeRex Education Center theme (<= 3.6.12) containing a malicious serialized PHP object in a parameter that the theme passes to unserialize(). If a suitable POP gadget chain is reachable, the injected object triggers code execution, file operations, or data tampering during deserialization. No public proof-of-concept exploit is identified in the provided data at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in the ThemeRex Education Center WordPress theme (versions up to and including 3.6.12) lets remote attackers feed serialized data into an unserialize() sink with no authentication and no user interaction, scored CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Actual damage depends on whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins, because that determines whether object injection escalates to code execution or full confidentiality, integrity, and availability loss. No public exploit code and no CISA KEV listing were identified at time of analysis, and real-world exposure is constrained by the narrow installed base of this specific commercial theme.
RemediationAI
No exact vendor fix version is confirmed in the available intelligence, so the primary step is to consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/education/vulnerability/wordpress-education-center-theme-3-6-12-php-object-injection-vulnerability?_s_id=cve for the released patched version and update the Education Center theme immediately once it is published; until then, treat 3.6.12 and earlier as vulnerable. If no update is available, a decisive compensating control is to temporarily deactivate the Education Center theme and serve the site with an alternative theme, which removes the unserialize() attack surface entirely but will change site layout and may break theme-specific templates and shortcodes. A less disruptive option is a web application firewall or reverse-proxy rule that rejects requests containing PHP serialization markers such as O: followed by a class-name length, or a: with array indices, across query strings, POST bodies, cookies, and headers; this blocks the common delivery pattern, although encoding or obfuscation can evade it and legitimate serialized form data may trigger false positives. Because realized impact requires a usable POP gadget chain, trimming the installed plugin and theme footprint to eliminate known gadget chains can reduce blast radius, but it is not a substitute for patching; restricting administrative access and monitoring logs for serialization-pattern requests add detection value only and do not prevent exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic PHP object injection (CWE-502, deserialization of untrusted data) in the ThemeRex Education Center WordPress theme, where attacker-controllable input reaches PHP's unserialize() function. Passing untrusted data to unserialize() allows an attacker to instantiate arbitrary objects and control their properties, but object injection by itself is only a primitive: it becomes remote code execution, arbitrary file deletion, SQL injection, or privilege escalation when a reachable property-oriented programming (POP) gadget chain exists through magic methods such as __wakeup, __destruct, __toString, or __call in the theme, WordPress core, or any other installed plugin. The assessed CVSS vector confirms a network-reachable, low-complexity, unauthenticated path with no user interaction and unchanged scope, consistent with an unsanitized deserialization endpoint exposed on the theme's front end rather than behind admin authentication. The supplied CPE, cpe:2.3:a:themerex:education_center:*:*:*:*:*:*:*:*, identifies the ThemeRex Education Center theme as the only affected product in the dataset, and the single Patchstack reference is version-specific to Education Center 3.6.12.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization (AV:N/AC:L/PR:N/UI:N); PHP object injection via a gadget chain can yield code execution, so C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
Executive ViewAI
A critical unauthenticated flaw in the ThemeRex Education Center WordPress theme (versions through 3.6.12) allows any outside attacker to inject PHP objects into a site without credentials or user interaction, potentially leading to full loss of confidentiality, integrity, and availability. Because no vendor patch exists yet, every organization running this theme - and the customers, partners, and data hosted on those sites - remains exposed until mitigating controls are put in place. Leadership should treat any internet-facing instance of this theme as a priority remediation item despite the theme's limited install base.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or deactivate the ThemeRex Education Center theme where not required; deploy WAF or virtual patching rules to block serialized payloads reaching unserialize() sinks; restrict public exposure; monitor logs, file integrity, and PHP object-injection attempts; and inventory co-installed plugins and WordPress core for POP gadget chains.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB