EUVD-2026-64809
GHSA-vxvv-qcm6-46hj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running FreightCo theme
-
DeliveryCraft serialized PHP object payload
-
ExploitSubmit payload to unserialize sink
-
ExecutionTrigger gadget chain on deserialization
-
ImpactAchieve code execution or data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a FreightCo installation (≤1.1.15) expose the vulnerable code path that feeds untrusted input into unserialize(), reachable over the network without authentication per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is gadget availability: PHP object injection only produces meaningful impact (RCE, file operations, SQLi) when an exploitable gadget chain exists in the theme, an active plugin, or WordPress core on the target, so a hardened site with few gadget-bearing classes may face reduced impact. No user interaction and no valid credentials are needed, and the theme must be installed and active on the site. |
| Impact | The signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 critical) describes an easily reachable, unauthenticated, network-based flaw with total impact - a strong prioritization case. However, no EPSS score, no SSVC decision, no KEV listing, and no public exploit code were provided, so real-world exploitation is unproven; the actual severity of a PHP object-injection bug also hinges on whether a usable gadget chain exists in the victim's deployed code, which is not confirmed here. Practically, the deciding factor is exposure: because it is pre-authentication in an internet-facing WordPress theme, organizations running FreightCo should treat it as high priority and patch promptly, while recognizing the impact ceiling depends on installed gadgets rather than assuming guaranteed RCE. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to an internet-facing FreightCo site, placing a serialized PHP object payload into a parameter, cookie, or option value that the theme passes to unserialize(). If a suitable gadget chain is present in the theme, bundled plugins, or WordPress core, deserializing the payload triggers the chain and yields file write, data access, or code execution. No public proof-of-concept is identified at time of analysis, so an attacker would need to construct the gadget chain themselves. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 24, 2026
PHP Object Injection in the FreightCo WordPress theme (versions up to and including 1.1.15) lets remote attackers pass attacker-controlled serialized data into an unsafe unserialize() call, enabling exploitation of PHP object gadget chains. The flaw is unauthenticated (CVSS 3.1 vector PR:N) and carries a critical 9.8 base score, and per the CVSS vector it can lead to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.
RemediationAI
No vendor-released patch version is identified in the available data (affected versions are given as 'n/a ≤1.1.15' with no fixed release noted), so consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/freightco/vulnerability/wordpress-freightco-theme-1-1-15-php-object-injection-vulnerability) and the ThemeRex vendor page for an updated build and upgrade as soon as a fixed version is published. Until a patched theme is available, apply compensating controls: deploy a WordPress WAF or virtual patch (Patchstack offers one) to block serialized-object payloads (strings containing patterns like O:<n>: or a:<n>:) in requests to the theme; restrict or disable the specific theme endpoints/features that accept the untrusted input where they are not needed, accepting possible loss of that functionality; and consider switching to an alternate theme if no fix is forthcoming. Each of these reduces exposure but does not remove the underlying unserialize() sink, so patching remains the real fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FreightCo is a commercial WordPress theme (CPE cpe:2.3:a:theme-rex:freightco) distributed by ThemeRex. The root cause is CWE-502, Deserialization of Untrusted Data: user-supplied input reaches a PHP unserialize() operation without validation, allowing an attacker to instantiate arbitrary PHP objects. When such objects have magic methods (__wakeup, __destruct, __toString) in the theme or in bundled plugins/WordPress core, a crafted 'gadget chain' can be triggered during or after deserialization to achieve outcomes such as arbitrary file operations, SQL injection, or remote code execution, depending on the gadgets available in the target's loaded code. WordPress themes are a common source of object-injection sinks because they frequently deserialize option values, cookies, or request parameters.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable unserialize() sink with no user interaction (AV:N/AC:L/PR:N/UI:N); PHP object injection can yield full RCE-level compromise, so C/I/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.
Articles & Coverage 1
Executive ViewAI
Organizations running the FreightCo WordPress theme (versions 1.1.15 and earlier) face a critical remote code execution risk that requires no authentication and can result in full compromise of affected websites and backend systems. Any public-facing WordPress installation using this theme is immediately vulnerable to data theft, service disruption, and malware deployment. Leadership attention is required to identify affected assets and implement emergency controls within 24 hours.
Implement WAF rules to filter PHP serialization payloads; restrict WordPress admin panel access by IP whitelist; deploy real-time intrusion detection monitoring for exploitation signatures; disable unnecessary theme features via code modification if vendor support available; consider temporary site outage as safer alternative to running unpatched installation; maintain offline backups to enable rapid recovery if exploitation occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB