EUVD-2026-96523
GHSA-67gf-mq47-63m5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress site with Kicker theme
-
DeliverySend crafted serialized PHP payload
-
ExploitTrigger unsafe unserialize() (object injection)
-
ExecutionInvoke POP gadget chain
-
ImpactExecute code or manipulate files/database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must run the Kicker WordPress theme at version 2.2.1 or earlier on a network-reachable WordPress site; exploitation is unauthenticated (PR:N) and needs no user interaction (UI:N), so default installs are exposed. The key LIMITING factor specific to CWE-502: a successful high-impact outcome requires a reachable PHP object-injection sink reached by attacker input AND an available POP gadget chain in the theme, an installed plugin, or WordPress core - on a site with no usable gadget chain the practical impact may be substantially reduced. No non-default configuration, authentication, or platform-specific prerequisite beyond having the vulnerable theme active is indicated in the provided data. |
| Impact | This is a CVSS 9.8 critical rating driven by a fully remote, unauthenticated vector (AV:N/AC:L/PR:N/UI:N) against the Kicker WordPress theme, with high confidentiality, integrity, and availability impact. The core weakness is CWE-502 PHP Object Injection, which - if a usable POP (property-oriented programming) gadget chain is present in the theme or any co-installed plugin/WordPress core - can escalate to remote code execution, arbitrary file operations, or SQL injection. Signal reconciliation: no EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so despite the 9.8 base score there is NO evidence of active or at-scale exploitation at this time. The practical severity of object injection is also conditional: the 9.8 assumes a reachable gadget chain, which Patchstack's rating implies but the single-reference input does not independently prove. Net: treat as a high-priority patch for anyone running the Kicker theme (unauthenticated + network-reachable is the dangerous combination), but recognize the real-world risk is currently theoretical rather than confirmed-exploited, and the true impact hinges on gadget-chain availability in the target's full plugin/theme stack. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running the Kicker theme (<= 2.2.1), supplying attacker-controlled serialized PHP data to an input that is passed to unserialize(). If a suitable gadget chain exists in the theme, an installed plugin, or WordPress core, deserialization triggers it to achieve code execution or file/database manipulation. No public exploit code or POC is identified in the provided data, so weaponization would require the attacker to locate a working gadget chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in the Kicker WordPress theme (AxiomThemes), affecting versions 2.2.1 and earlier, lets any remote attacker reach an unsafe PHP deserialization sink without credentials or user interaction - the only prerequisite is that the theme is active on a network-reachable WordPress site. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, high C/I/A), the practical severity hinges on CWE-502's classic caveat: achieving code execution, file deletion, or data exfiltration requires a usable POP gadget chain in the theme, an installed plugin, or WordPress core, so impact may be materially lower on sites without a suitable chain. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; Patchstack published the advisory and no vendor-released patch has been confirmed in the provided data.
RemediationAI
No vendor-released patch was identified at time of analysis; the only authoritative reference supplied is the Patchstack advisory at https://patchstack.com/database/wordpress/theme/kicker/vulnerability/wordpress-kicker-theme-2-2-1-php-object-injection-vulnerability, which should be monitored for a fixed theme version before relying on any specific upgrade target - do not assume that a version above 2.2.1 is patched until the vendor or Patchstack confirms it. The most effective immediate action is to stop exposing the vulnerable code path: if the Kicker theme is not the active production theme, remove it entirely rather than leaving it installed, since deactivated themes can still register classes and sinks; if it is the active theme, migrate to a maintained alternative and take the visual/functional regression as an accepted trade-off. Where switching themes is not immediately feasible, front a WAF or reverse-proxy rule set that inspects request parameters, cookies, and headers for the PHP serialization signatures (O:<digits>:" and C:<digits>:") and blocks them - accepting that pattern matching is bypassable through encoding, object-length manipulation, and nested payloads. Because the entry point is unauthenticated (PR:N) with no user interaction (UI:N), restricting access by IP or authentication is not a viable general control; instead reduce gadget availability by auditing installed plugins for known POP chains and removing unused or unmaintained ones, which lowers the chance that a reachable deserialization sink can be escalated to code execution, file deletion, or SQL manipulation. Finally, enable PHP-level monitoring or an application firewall with deserialization heuristics and alert on unexplained file writes, new admin users, and outbound connections from the web tier, as these are the observable outcomes of a successful gadget chain.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a textbook CWE-502 (Deserialization of Untrusted Data) flaw in the Kicker WordPress theme distributed by AxiomThemes, tracked under CPE cpe:2.3:a:axiomthemes:kicker:*:*:*:*:*:*:*:* for all versions up to and including 2.2.1. PHP's unserialize() reconstructs arbitrary objects and triggers magic methods such as __wakeup(), __destruct(), and __toString(), so when attacker-controlled serialized payloads (the familiar O:<length>:"ClassName":... format) reach an unserialize() call in the theme, the attacker can instantiate objects of their choosing and steer execution through whatever magic methods those classes implement. Because WordPress routinely loads the theme alongside dozens of plugins and core classes in the same process, the attacker's goal is to chain these magic methods into a POP (property-oriented programming) gadget chain that ends in a dangerous sink - file writes, arbitrary file deletion, SQL execution, or command execution. This dependency on a reachable, populated gadget chain is the structural reason why a 9.8 base score can overstate real-world exploitability on a hardened site with a minimal plugin footprint; the unserialize() entry point is confirmed, but the gadget chain is an environmental variable rather than a fixed property of the theme.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote request reaches the deserialization sink (AV:N/PR:N/UI:N); AC:L and full C/I/A:H assume a reachable gadget chain, consistent with unauthenticated PHP object injection.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
Executive ViewAI
The Kicker WordPress theme (AxiomThemes), versions 2.2.1 and earlier, carries a critical unauthenticated PHP object injection flaw that any remote attacker can reach on an internet-facing site where the theme is active. With no vendor patch available, every organization running this theme on a publicly reachable WordPress site holds unmitigated exposure to potential full site compromise, including data theft, defacement, or use of the site as a foothold into adjacent systems. Leadership should treat this as a time-bound brand, availability, and data-protection risk until the theme is removed or a fix is published.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the Kicker theme (2.2.1 and earlier) on all affected sites; if the theme must remain active, restrict network reachability to the WordPress site and apply WAF virtual patching for PHP object injection; reduce exploitable gadget chains by reviewing and removing unnecessary plugins and hardening WordPress core; enable logging and monitor for serialized data or unexpected deserialization activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB