Buzz Stone Theme CVE-2026-81797

Requires the Buzz Stone | Magazine & Viral Blog WordPress theme (vendor themerex) to be installed and active at version 1.0.2 or earlier, with a request path that feeds attacker-supplied serialized data into an unsafe PHP unserialize() call. Exploitation is unauthenticated and needs no user interaction (PR:N/UI:N), but meaningful impact (RCE, file or data operations) depends on a usable PHP object-injection (POP) gadget chain being present in the theme, WordPress core, or a co-installed plugin - absent a reachable gadget, impact may be limited. The primary limiting factor is deployment: only sites running this specific niche theme are affected.

All provided signals point to a maximum-severity, easily exploitable flaw on paper: the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality, integrity and availability impact (9.8 Critical), and CWE-502 (deserialization of untrusted data / PHP Object Injection) is a well-understood class that can escalate to remote code execution, file operations, or SQL injection. However, the real-world risk is more nuanced than the 9.8 suggests. No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. Critically, PHP Object Injection impact depends on the availability of a usable POP (property-oriented programming) gadget chain in the theme, WordPress core, or co-installed plugins; without a reachable gadget the injection may be benign, which is a common reason such bugs score 9.8 but see limited real-world weaponization. The dominant mitigating factor is prevalence: Buzz Stone is a niche commercial WordPress theme with a small installed base, so even a wire-ready exploit would have a narrow target population. Net: treat as a high-priority patch for any site actually running this theme, but it is more likely to be opportunistically scanned than mass-exploited, and the headline 9.8 overstates fleet-wide urgency given low deployment and unconfirmed gadget-chain exploitability.

A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running the Buzz Stone theme (<= 1.0.2), passing attacker-controlled serialized data into a parameter that the theme deserializes via unsafe PHP unserialize(). If a suitable POP gadget chain exists in the theme, core, or an installed plugin, this triggers object instantiation leading to code execution, file writes, or data access. No public PoC is referenced in the provided data, and the low attack complexity (AC:L) means exploitation needs no special timing or race conditions.