Photolia CVE-2026-78535

The vulnerable Photolia theme (versions <= 1.0.3) must be installed and active on a WordPress site, and the attacker must reach the theme code path that passes untrusted input to PHP unserialize(). Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required, so default installations are exposed over the network. The key LIMITING factor inherent to CWE-502 object injection is that achieving code execution or other meaningful impact requires a usable POP gadget chain present in WordPress core or a co-installed plugin/theme; absent a reachable gadget chain, realized impact may be reduced. Exploitation is further bounded to the specific population of sites running this theme at or below 1.0.3.

All signals point to a high-severity but likely low-to-moderate real-world priority. The Patchstack-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes a network-reachable, unauthenticated flaw with full confidentiality/integrity/availability impact - the theoretical worst case for a web application. However, the only intelligence source is a single Patchstack advisory; there is NO EPSS score, NO CISA KEV listing, and NO public exploit referenced, so no public exploit identified at time of analysis. The practical caveat with CWE-502 PHP Object Injection is that the 9.8 rating assumes a usable POP (property-oriented programming) gadget chain is reachable - such chains are frequently present in WordPress core or co-installed plugins, but the advisory does not confirm a working chain in Photolia itself, so the maximal impact is plausible but unverified. SSVC inputs (exploitation status, automatable, technical impact) were not provided and cannot be assessed. Net: treat as a patch-now item for any site running Photolia <= 1.0.3, but the limited product footprint plus the absence of exploitation and EPSS signals argue against emergency, fleet-wide prioritization.

A remote, unauthenticated attacker sends a crafted request to a Photolia theme endpoint that passes attacker-controlled data to PHP unserialize(). By supplying a serialized object that triggers an existing POP gadget chain (in WordPress core or an installed plugin), the attacker can achieve file operations or remote code execution on the host. No public proof-of-concept is referenced, so weaponization would require identifying a viable gadget chain for the target environment.