EUVD-2026-96528
GHSA-pvr3-238r-qr3r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Qwery <= 3.6.1
-
DeliverySend crafted serialized PHP payload
-
ExploitTrigger unsafe deserialization (CWE-502)
-
ExecutionInstantiate malicious object via gadget chain
-
ImpactExecute code or manipulate data as web user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a vulnerable Qwery theme (version 3.6.1 or earlier) be installed and active on an internet-reachable WordPress site, and that attacker-controlled input reach a code path performing PHP deserialization of untrusted data. No authentication or user interaction is required (PR:N/UI:N). The key limiting factor is gadget availability: PHP Object Injection yields meaningful impact (RCE, file write, SQL injection) only when an exploitable gadget chain exists in WordPress core, the theme, or installed plugins; absent a usable chain, impact may be reduced. Upgrading beyond 3.6.1 (fixed version not confirmed in provided data) and restricting the affected theme endpoint limit exposure. |
| Impact | All available severity signals align toward high theoretical risk: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with full C/I/A impact, consistent with CWE-502 PHP Object Injection that can escalate to remote code execution when an exploitable gadget chain is present in the WordPress stack. However, the exploitability signals are thin: no EPSS probability was provided, the CVE is NOT in CISA KEV, and no public POC is referenced - so there is no public exploit identified at time of analysis and no evidence of active, widespread exploitation. The practical risk of object-injection bugs is also gadget-dependent: impact is 'confirmed' as high by the CVSS vector and Patchstack reporting, but whether full RCE is achievable in a given install depends on available gadget chains in WordPress core, the theme, and co-installed plugins - a factor the raw 9.8 does not capture. Net: a genuinely high-severity, easy-to-attempt flaw that warrants prompt patching, but current real-world exploitation pressure is unconfirmed, and the modest deployment footprint of a premium theme likely keeps exploitation targeted rather than mass-scale. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a vulnerable Qwery theme endpoint carrying a malicious serialized PHP payload, which is deserialized by the application. If a suitable gadget chain exists in the WordPress environment, this triggers object injection leading to arbitrary file operations, SQL manipulation, or remote code execution. No public exploit code is referenced, but the AV:N/AC:L/PR:N/UI:N vector means the attack requires no authentication, no user interaction, and little sophistication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in the Qwery WordPress theme (versions 3.6.1 and earlier) allows any remote attacker who can reach an affected site to pass crafted serialized data into a PHP deserialization sink, with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, rated 9.8). Because the flaw is CWE-502, real-world impact depends on whether an exploitable PHP gadget chain exists in WordPress core, the theme, or any installed plugin; if such a chain is reachable, the issue can escalate to remote code execution, arbitrary file write, or SQL injection, otherwise impact may be reduced. At the time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, though the unauthenticated network vector and full C/I/A rating make the theme a high-priority item for any internet-facing WordPress installation running it.
RemediationAI
No vendor-released patched version is confirmed in the provided data - the advisory establishes only that version 3.6.1 is vulnerable, so the fixed release must be verified on the Patchstack advisory (https://patchstack.com/database/wordpress/theme/qwery/vulnerability/wordpress-qwery-theme-3-6-1-php-object-injection-vulnerability?_s_id=cve) or the theme vendor's changelog before relying on it; if a patched build is not yet published, the safest course is to deactivate and remove the Qwery theme entirely and switch to a maintained alternative, accepting the cost of site redesign. If removal is not immediately possible, reduce exposure by deactivating the theme on non-production or non-public sites and, where the theme must stay live on a public site, place the site behind a WAF or reverse proxy rule that blocks requests carrying PHP serialization payloads (patterns such as 'O:<digits>:"' or 'a:<digits>:{' in parameters, cookies, and JSON bodies) - noting that legitimate plugin traffic can occasionally match these patterns and cause false positives that should be baselined first. Because the deserialization primitive only becomes dangerous in the presence of a gadget chain, an interim hardening step is to audit and remove unused or abandoned plugins that supply known PHP gadget classes, which shrinks the attack surface but does not eliminate the underlying flaw. Keep WordPress core and all plugins current, restrict administrative endpoints, and monitor logs for serialized-object payloads until a confirmed fixed theme version is installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Qwery theme, published by AncoraThemes and distributed through the WordPress theme ecosystem, is affected by PHP Object Injection (CWE-502). This class of bug arises when attacker-controlled input is passed to PHP's unserialize() (directly, or indirectly through a library or framework wrapper) without adequate validation, allowing an attacker to instantiate arbitrary PHP objects and control their properties. The CPE string cpe:2.3:a:ancorathemes:qwery:*:*:*:*:*:*:*:* confirms the vendor/product binding but leaves the version wildcarded, so the affected range must be taken from the advisory: all versions up to and including 3.6.1. Exploitability is governed by gadget availability - the deserialization primitive itself only becomes RCE, file write, or SQL injection when a usable magic-method chain (__wakeup, __destruct, __toString, etc.) exists in the loaded WordPress codebase, which is why identical CVSS vectors can yield very different real-world outcomes across sites with different plugin sets. The CVSS 3.1 vector supplied with the advisory describes the worst-case, gadget-present scenario.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization with no user interaction (AV:N/AC:L/PR:N/UI:N); object injection can yield full code execution giving high C/I/A.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
Executive ViewAI
The Qwery WordPress theme, used by organizations for their public websites, contains a critical unauthenticated PHP object injection vulnerability (CVE-2026-78533) that could allow attackers to compromise the site and potentially the underlying server. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis, but with a CVSS score of 9.8, this poses a high risk to organizational reputation and data security. Immediate mitigation steps are required to protect affected sites.
No vendor-released patch identified at time of analysis. Interim mitigations include deploying a Web Application Firewall (WAF) with rules to block PHP object injection attempts targeting the Qwery theme, disabling the theme if not essential, restricting network access to affected sites, and monitoring for exploitation indicators. Virtual patching via security vendors may also be available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB