EUVD-2026-96524
GHSA-hj6g-q8vx-x324
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site using Alliance theme ≤3.11
-
DeliverySend crafted serialized PHP payload
-
ExploitTrigger unsafe unserialize() (object injection)
-
ExecutionInvoke POP gadget chain
-
ImpactExecute code / tamper data on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a WordPress installation with the ThemeREX Alliance theme at version 3.11 or earlier active, reaching a code path that calls PHP unserialize() on attacker-controlled input. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed and the attack is remote over the network against default installations. The key limiting factor not captured by the CVSS score is the availability of a usable POP gadget chain (in the theme, WordPress core, or other installed extensions) - PHP Object Injection yields serious impact only when such gadgets are reachable, so sites lacking an exploitable chain may face reduced practical impact. |
| Impact | All CVSS base metrics point to maximum severity: AV:N/AC:L/PR:N/UI:N yields a 9.8 critical score, meaning remote, unauthenticated, low-complexity exploitation with no user interaction and full C/I/A impact. CWE-502 (deserialization of untrusted data) via unauthenticated PHP Object Injection is a well-understood, high-value bug class that, given a usable POP gadget chain (often present in WordPress core or other installed plugins/themes), can escalate to remote code execution or arbitrary file operations. However, the signals are incomplete: no EPSS probability, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or at-scale exploitation at this time. The practical risk therefore hinges on whether a reachable gadget chain exists in a given deployment - object injection is only as dangerous as the gadgets available - which is not confirmed here. Net assessment: treat as a genuine high priority for patching due to the unauthenticated network-facing nature and critical CVSS, while recognizing that the absence of EPSS/KEV/POC means real-world exploitation is currently unproven rather than demonstrated. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running the ThemeREX Alliance theme (<= 3.11), supplying a malicious serialized PHP object to an endpoint that deserializes attacker input. If a suitable POP gadget chain is reachable, the injected object triggers unintended method calls during unserialization, enabling outcomes up to remote code execution or file manipulation. No public exploit code was identified in the provided data, and no user interaction or authentication is required per the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP Object Injection in the ThemeREX Alliance WordPress theme (versions 3.11 and earlier) allows remote attackers to pass crafted serialized data into a PHP unserialize() call, which can lead to arbitrary object instantiation and, where a usable POP gadget chain exists, full compromise of the underlying site with high impact to confidentiality, integrity and availability. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no authentication or user interaction is required and default installations are reachable over the network; at time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, though the EPSS-style risk profile of an unauthenticated WordPress theme flaw of this class typically rises quickly once details circulate. Practical impact depends on the presence of a reachable gadget chain in the theme, WordPress core, or other installed plugins; sites without such a chain may see reduced, but still material, exposure because the injection primitive itself is remotely reachable.
RemediationAI
No vendor-released patch version is identified in the available advisory data at time of analysis, so the first action is to check the ThemeREX/Alliance vendor release notes and the Patchstack advisory (https://patchstack.com/database/wordpress/theme/alliance/vulnerability/wordpress-alliance-theme-3-11-php-object-injection-vulnerability?_s_id=cve) for a fixed build and apply it immediately once published; upgrading to the newest available theme release is the primary remediation. If no patched version can be obtained, the most effective compensating control is to deactivate the Alliance theme and switch to an actively maintained theme, accepting the loss of the site's current design and any theme-specific customizations. Where the theme must stay live, reduce the attack surface by placing a Web Application Firewall or reverse-proxy rule set in front of the site that blocks serialized-object payloads (patterns such as O:\d+:" and C:\d+:" in query strings, POST bodies and cookies), understanding that obfuscated or encoded payloads can evade signature rules and the measure is not a substitute for patching. Also keep WordPress core and every installed plugin updated, because the practical severity of a PHP Object Injection bug is determined by which gadget chains are autoloadable - removing outdated plugins with known __destruct/__wakeup gadgets measurably reduces exploitability. Restricting administrative and REST access by IP allow-listing, disabling unused plugins, and monitoring logs for anomalous deserialization patterns can further limit impact, though none of these eliminate the underlying unauthenticated injection primitive.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic PHP Object Injection (CWE-502, insecure deserialization) in the ThemeREX Alliance WordPress theme. WordPress themes routinely persist and retrieve structured option data, and unserialize() is a common (and dangerous) way to reconstitute arrays and objects from database rows, transients, cookies, or POST parameters. When attacker-controlled input reaches unserialize() without integrity protection, PHP instantiates objects of any class available in the loaded codebase, invoking their __wakeup() and __destruct() magic methods; an attacker who can chain those methods into a POP (property-oriented programming) gadget chain can pivot from deserialization to arbitrary file operations, option updates, SQL execution, or remote code execution depending on which classes are autoloadable. The CPE string cpe:2.3:a:themerex:alliance:*:*:*:*:*:*:*:* identifies the affected component as the ThemeREX Alliance theme across its version range up to and including 3.11, and the CVSS vector AV:N/AC:L/PR:N/UI:N confirms the injection point is network-reachable and requires no prior authentication or victim interaction. The reputational and structural context matters here: theme-level object injection is frequently exploited at scale by automated scanners that crawl for WordPress themes with known vulnerable parameters, which is why a 9.8 unauthenticated deserialization bug in a widely deployed commercial theme is treated as high priority even before a public proof of concept appears.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote object injection with no user interaction (AV:N/AC:L/PR:N/UI:N); a reachable gadget chain can yield full compromise, so C:H/I:H/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
Executive ViewAI
The ThemeREX Alliance WordPress theme (versions 3.11 and earlier) contains a critical unauthenticated PHP Object Injection flaw that can allow remote attackers to fully compromise affected websites. No vendor-released patch identified at time of analysis, and while no public exploit identified at time of analysis, the issue is network-reachable without credentials and carries high impact to confidentiality, integrity, and availability. Leadership should prioritize identifying and mitigating all sites using this theme because successful exploitation could lead to site takeover, data theft, and operational disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove ThemeREX Alliance versions 3.11 and earlier; replace with a supported theme; deploy WAF rules to block PHP object injection attempts; restrict access to wp-admin and XML-RPC where possible; monitor logs for serialized payloads, new admin accounts, file modifications, and outbound callbacks; and maintain offline backups for rapid recovery.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB