EUVD-2026-63303
GHSA-mwfw-263q-69wc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Flatastic <= 2.0
-
DeliveryCraft malicious serialized PHP object
-
ExploitSubmit payload to vulnerable endpoint
-
Executionunserialize() instantiates attacker objects
-
PersistPOP gadget chain executes
-
ImpactCode execution or site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Flatastic theme (version <= 2.0) be installed and active, and that the attacker can reach the specific theme code path that passes untrusted input into unserialize(). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed against a reachable instance. The principal limiting factor is that meaningful impact (RCE/data manipulation) depends on a suitable POP gadget chain existing in the installed WordPress core/plugins/theme; without a reachable gadget chain the object injection may yield limited or no impact. The exact vulnerable parameter/endpoint is not specified in the available data. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) marks this as network-reachable, low-complexity, and unauthenticated, which is the highest-priority profile for internet-facing WordPress sites. However, key exploitation signals are missing: there is no EPSS score, no SSVC decision data, no KEV listing, and no public POC identified, so the practical exploitability is not yet corroborated by exploitation-in-the-wild evidence. A critical caveat for object-injection bugs is that the C:H/I:H/A:H rating assumes a usable POP gadget chain is reachable - if no gadget chain is present in a given installation, real-world impact can be substantially lower than 9.8 implies; conversely, sites with many plugins are more exposed. Net assessment: treat as a genuine high priority for any live Flatastic deployment because the vulnerability is unauthenticated and remotely reachable, but the absence of EPSS/KEV/POC signals suggests the current threat is potential rather than confirmed mass exploitation. |
| Exploit ScenarioDerived | An unauthenticated attacker crafts a malicious serialized PHP object and submits it to the vulnerable Flatastic input over the network; when the theme calls unserialize() on it, the payload triggers a POP gadget chain in a loaded PHP class, leading to code execution or file/database manipulation and full site compromise. Because the CVSS complexity is low and no authentication or user interaction is needed, the attack can be scripted against exposed sites. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
PHP Object Injection in the Flatastic WordPress theme (versions 2.0 and earlier, by author monkeysan) lets unauthenticated remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, potentially achieving remote code execution, data theft, or site takeover if a suitable POP gadget chain is present in the WordPress core, plugins, or theme. Reported by Patchstack and rated CVSS 9.8, it requires no authentication or user interaction. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
No vendor-released patched version is confirmed in the provided data, so the exact fix version cannot be cited; monitor the Patchstack advisory (https://patchstack.com/database/wordpress/theme/flatastic/vulnerability/wordpress-flatastic-theme-2-0-php-object-injection-vulnerability) and the theme author for a release above 2.0 and upgrade as soon as it is published. In the interim, deploy a WordPress WAF/virtual patch (Patchstack or equivalent) to filter serialized PHP payloads reaching the vulnerable entry point, which has minimal functional side effects; restrict or disable the specific theme functionality that accepts the untrusted input if it can be identified, accepting the trade-off of reduced theme features; and reduce the pool of exploitable gadget chains by removing unused plugins and keeping WordPress core and remaining plugins fully updated. Consider taking the site offline or moving to a supported theme if it is high-value and no patch materializes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-502 (Deserialization of Untrusted Data). Flatastic is a commercial WordPress theme (CPE cpe:2.3:a:monkeysan:flatastic), meaning it runs inside a full PHP/WordPress stack. PHP Object Injection occurs when user-supplied input reaches unserialize() without validation, allowing an attacker to instantiate arbitrary PHP objects and control their properties. Exploitation weaponizes 'POP gadget chains' - sequences of magic methods (__wakeup, __destruct, __toString) in loaded classes - so the realized impact depends heavily on which gadgets exist across WordPress core and other installed plugins, not on the theme alone.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization with no user interaction gives AV:N/AC:L/PR:N/UI:N; C/I/A rated High assuming a reachable POP gadget chain enables RCE/data compromise.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.
Articles & Coverage 1
Executive ViewAI
The Flatastic WordPress theme (versions 2.0 and earlier) contains a critical PHP object injection vulnerability allowing unauthenticated attackers to execute arbitrary code and compromise affected websites. Any organization using this theme faces immediate risk of site takeover, data theft, and malware injection, with no vendor patch currently available to remediate the exposure.
Until theme removal is complete: (1) disable the vulnerable theme and revert to an alternative; (2) implement WAF rules to detect and block requests containing serialized PHP objects; (3) restrict WordPress admin and plugin upload directories to known IP ranges if feasible; (4) enable and monitor WordPress security event logs for suspicious activity; (5) maintain current, tested backups to enable rapid recovery; (6) disable or restrict PHP's unserialize() function if application architecture permits, and implement strict input validation for any user-controlled data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB