EUVD-2026-96517
GHSA-vfx8-984f-hxhg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted request to theme endpoint
-
DeliveryDeliver malicious serialized PHP object
-
ExploitTrigger unserialize() object injection
-
ExecutionInvoke gadget chain in loaded code
-
ImpactExecute attacker actions as web user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach a Windsor theme code path (version <= 2.10) that passes attacker-supplied input into PHP unserialize(), which per the CVSS vector needs no authentication (PR:N) and no user interaction (UI:N) against a default install. The decisive limiting factor is that PHP Object Injection yields real impact (RCE, file or data operations) only when a usable 'gadget' chain of magic methods exists in the theme, WordPress core, or an installed plugin; without a reachable gadget chain the injection may be inert or limited. Realistic risk is therefore bounded by the specific plugin/theme/core combination deployed on the target site rather than by the theme alone. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a fully network-reachable, unauthenticated, low-complexity flaw with total confidentiality, integrity, and availability impact - the maximal-severity profile for an application-layer bug, consistent with CWE-502 (deserialization) leading to PHP Object Injection. No EPSS score, no KEV listing, and no POC indicator were provided in the intelligence set, so exploitation likelihood cannot be quantified: there is no public exploit identified at time of analysis and no confirmation of active exploitation. An important caveat tempers the raw score: PHP Object Injection is only directly weaponizable into code execution, file operations, or data theft when a usable gadget chain exists in the theme, WordPress core, or co-installed plugins - the AC:L rating assumes such a chain is readily reachable, which is not independently confirmed here. The single source is Patchstack, a reputable WordPress-vulnerability vendor, which lends credibility to the finding itself but the absence of any corroborating vendor (ThemeREX) advisory, EPSS, or exploitation signal means this is currently a high-potential-severity issue without evidence of real-world weaponization. Treat as a patch-priority for any site running the Windsor theme, but recognize the real-world exploited-risk signal is presently unproven rather than confirmed. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a vulnerable endpoint of the Windsor theme (<= 2.10) containing an attacker-controlled serialized PHP object, which the theme passes to unserialize(). If a suitable gadget chain is present in the theme, WordPress core, or an installed plugin, the injected object triggers that chain on instantiation/destruction, enabling actions such as arbitrary file write, SQL manipulation, or remote code execution. No public exploit code was identified in the provided data, and reachability of a working gadget chain determines whether impact reaches full RCE. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in the WordPress theme Windsor (ThemeREX) through version 2.10 lets remote attackers feed crafted serialized data into an unserialize() call reachable without authentication or user interaction, scoring a maximum base 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Reported by Patchstack and tracked as CWE-502, the flaw's realized impact depends on whether a usable PHP gadget chain exists across the theme, WordPress core, and installed plugins - in an unpatched site with a suitable gadget, this can escalate to code execution, arbitrary file or data manipulation, whereas without one the injection may be largely inert. At time of analysis there is no public exploit code identified and no CISA KEV listing, so exploitation is not confirmed in the wild; no vendor-released fix version appears in the available advisory data. Given the unauthenticated, network-reachable profile and the prevalence of gadget-rich plugin stacks, this should be treated as high priority for any site running the theme.
RemediationAI
No vendor-released patch version is identified in the available advisory data for Windsor at or below 2.10, so the primary action is to check the ThemeREX distribution channel and the Patchstack advisory (https://patchstack.com/database/wordpress/theme/windsor/vulnerability/wordpress-windsor-theme-2-10-php-object-injection-vulnerability?_s_id=cve) for a fixed release and apply it as soon as one is published. Until a patched version exists, the most effective control is to deactivate and remove the Windsor theme from production sites and replace it with an actively maintained alternative - the side effect being a theme migration effort, which is the strongest risk reduction available given this is an unauthenticated, network-reachable flaw with full C/I/A impact in the worst case. If the theme must stay in place, keep it inactive when not in use, move it out of the web root so its files are not directly reachable, and constrain exposure by fronting wp-content/themes/windsor paths with a WAF rule that blocks requests containing serialized-object markers such as 'O:' followed by a class name in parameters; this reduces but does not eliminate risk, since payload encoding can bypass naive pattern matching. Additionally, audit the installed plugin and core footprint for known gadget chains and remove unused plugins, because the practical severity of this object injection depends on whether a reachable gadget exists on the target - eliminating gadget sources lowers the chance the primitive becomes code execution. Finally, monitor logs for anomalous requests to theme endpoints and treat any such activity as a potential compromise signal pending a vendor fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic PHP object injection (CWE-502, deserialization of untrusted data) in the Windsor WordPress theme by ThemeREX, affecting the version range covered by the CPE cpe:2.3:a:themerex:windsor:*:*:*:*:*:*:*:* up to and including 2.10. Control flow reaches a PHP unserialize() call that accepts attacker-controlled input from a remote, unauthenticated request; because unserialize() reconstructs arbitrary PHP objects and invokes their magic methods (__wakeup, __destruct, __toString, and similar), an attacker who controls the serialized string controls object instantiation inside the WordPress process. Object injection is a primitive rather than an end in itself: its severity crystallizes only when an exploitable 'gadget chain' - a sequence of magic-method calls across theme classes, WordPress core classes, or classes registered by installed plugins - can be chained to reach a sensitive sink such as file write, file deletion, SQL execution, or callable dispatch. The supplied CVSS vector assigns the maximal application-layer impact profile (S:U, C:H/I:H/A:H) with no privileges or interaction required, which reflects the assumed worst case where such a chain is reachable; the independent assessment notes that realistic risk is bounded by the specific theme/core/plugin combination deployed, since a site lacking a reachable gadget chain may see only inert or limited injection behavior. PHP 7.x/8.x will emit warnings or throw on malformed serialized input, but validly structured payloads bypass those safeguards entirely, which is why object injection remains a high-signal class in WordPress ecosystems.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable, unauthenticated unserialize() injection (AV:N/PR:N/UI:N); AC:L retained to match the reported no-auth profile, with full C/I/A assuming a reachable gadget chain.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
Executive ViewAI
Any internet-facing WordPress site running the ThemeREX "Windsor" theme at version 2.10 or earlier can be reached by an unauthenticated, remote attacker who may be able to manipulate site data or execute code, with no login or user interaction required and no public exploit identified at time of analysis. Because the theme sits on publicly reachable web infrastructure and the realized impact depends on whether a usable PHP gadget chain exists across the site's plugins and core, leadership should treat this as a material risk to web presence, customer data, and brand trust until the theme is removed or a vendor fix is released. No vendor-released patch has been identified, so affected sites remain exposed for the foreseeable near term.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate and remove the Windsor theme (versions through 2.10) from all sites; apply WAF virtual patching to block crafted serialized-object payloads reaching theme endpoints; restrict access to theme entry points and administrative interfaces; reduce available PHP gadget chains by removing unused plugins and themes; and monitor logs and file integrity for deserialization attempts and unexpected changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB