EUVD-2026-96522
GHSA-7hr6-wjj3-8fvf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site using Original theme <= 1.9.0
-
DeliveryCraft malicious serialized PHP object
-
ExploitSend to vulnerable unserialize() endpoint
-
ExecutionTrigger POP gadget chain
-
ImpactAchieve code execution or data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The site must be running the AxiomThemes 'Original' WordPress theme at version 1.9.0 or earlier, and the vulnerable code path that passes attacker-controlled input to unserialize() must be reachable without authentication (consistent with PR:N). The decisive LIMITING factor is PHP Object Injection's dependency on a usable POP gadget chain: successful code execution or full compromise requires a suitable gadget to be present in the theme, WordPress core, or a co-installed plugin - without one, exploitation may be limited to lower-impact effects. No special non-default configuration or user interaction is indicated by the CVSS vector (UI:N). |
| Impact | All provided signals point to a high-severity issue but real-world risk requires nuance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) and CWE-502 (deserialization) support the 9.8 'Critical' rating, and the vulnerability is unauthenticated (PR:N confirmed in vector). However, several exploitation signals are MISSING: there is no EPSS score, no CISA KEV listing, and no evidence of public exploit code in the single provided Patchstack reference - so exploitation status is 'no public exploit identified at time of analysis.' A key caveat for PHP Object Injection: achieving the claimed C:H/I:H/A:H impact typically depends on a usable POP gadget chain being reachable in WordPress core, the theme, or co-installed plugins; the CVSS assumes worst-case gadget availability, so actual impact in a given environment can be lower than 9.8 suggests. Net: treat as a genuine high priority to patch given unauthenticated network reach, but note the absence of EPSS/KEV/POC means there is no evidence of widespread active exploitation, and the practical impact is gadget-chain-dependent - verify against your installed plugin set. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running the AxiomThemes 'Original' theme (<= 1.9.0), supplying a malicious serialized PHP object to a vulnerable input that reaches unserialize(). If a suitable POP gadget chain is present in the theme, WordPress, or an installed plugin, the injected object triggers that chain on instantiation/destruction. No public exploit code is identified at time of analysis, and real-world impact depends on the available gadget chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in the AxiomThemes 'Original' WordPress theme (all versions up to and including 1.9.0) lets a remote attacker reach a code path that passes attacker-controlled input into PHP's unserialize(), exposing affected sites to high impact across confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the root cause is CWE-502, the practical ceiling of exploitation depends on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin - without one, outcomes may be limited to lower-impact effects rather than full code execution. No public exploit code has been identified at time of analysis, there is no CISA KEV entry indicating confirmed active exploitation, and no EPSS score was supplied with the source data, so this should be treated as a severe latent exposure rather than a confirmed campaign.
RemediationAI
No vendor-released patch identified at time of analysis - the supplied data contains only the Patchstack advisory (https://patchstack.com/database/wordpress/theme/original/vulnerability/wordpress-original-theme-1-9-0-php-object-injection-vulnerability?_s_id=cve) and no fixed version number, so confirm current status there before acting. The most reliable mitigation is to stop running the theme: migrate to an actively maintained theme and delete the 'Original' directory rather than merely deactivating it, accepting the cost of a redesign and re-testing of templates; leaving an unused vulnerable theme on disk keeps the code available to any path that includes it. If removal is not immediately possible, restrict exposure by placing the site behind a WAF or reverse proxy that inspects POST bodies and cookies for PHP serialized object syntax (O:<number>:"..."), understanding that encoding, chunking, and parameter-name variation can evade signature-based filtering so this is a stopgap and not a fix. Reduce gadget surface by removing every unused plugin and theme, since object injection only escalates when a usable POP chain exists - the trade-off is that this audit takes time and may remove functionality, but it directly lowers the probability that an injected payload finds a destructive chain. Additionally, log and alert on anomalous requests to theme PHP files, apply virtual patching from Patchstack or your WAF vendor if available, and treat any site that ran the theme with unknown traffic as potentially compromised pending forensic review.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a commercial WordPress theme, AxiomThemes 'Original', tracked by the CPE cpe:2.3:a:axiomthemes:original:*:*:*:*:*:*:*:* and reported by Patchstack through its WordPress vulnerability database. The flaw class is CWE-502, Deserialization of Untrusted Data: PHP's unserialize() reconstructs arbitrary objects from an attacker-supplied string, and during reconstruction PHP invokes magic methods such as __wakeup(), __destruct(), and __toString() on the instantiated classes. In a WordPress deployment those classes come not only from the theme itself but from WordPress core and every active plugin, which is why object injection is a chain-construction problem - an attacker who controls the serialized payload searches the installed codebase for a POP (property-oriented programming) gadget chain that turns that object graph into file deletion, file write, SQL manipulation, or code execution. The assessed vector PR:N and UI:N indicates the vulnerable unserialize() path is reachable without credentials and without any victim interaction, and the network attack vector (AV:N) means it can be triggered remotely by an HTTP request. The scope is assessed as unchanged (S:U), so the exploit's direct impact is bounded to the vulnerable component's security authority, though a successful gadget chain would still affect the surrounding WordPress installation through whatever primitives the gadgets provide.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote input to unserialize() gives AV:N/AC:L/PR:N/UI:N; worst-case gadget-chain RCE justifies C:H/I:H/A:H, consistent with the reported vector.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
Executive ViewAI
The AxiomThemes 'Original' WordPress theme, in all versions up to and including 1.9.0, carries a critical unauthenticated flaw that can let an outside party push attacker-controlled data into a dangerous code path on any site running it. Because no vendor fix is currently available and the theme is widely deployed across small-business and marketing sites, leadership should treat this as a standing exposure that puts site content, customer data, and uptime at risk until affected sites are removed from the theme or otherwise isolated. The severity of any real-world outcome depends on whether a usable gadget chain exists in the theme, WordPress core, or a co-installed plugin, so the population of at-risk sites is broader than those that would ultimately be fully compromised.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or uninstall the affected theme where operationally feasible; deploy WAF virtual patching and request filtering against the theme's vulnerable code path; reduce the available gadget surface by removing unused plugins and keeping WordPress core and remaining plugins current; restrict file and database permissions; enable continuous file-integrity monitoring and review logs for anomalous serialized payloads or unexpected admin activity; and maintain verified, isolated backups to shorten recovery if a site is compromised.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB