EUVD-2026-96197
GHSA-h2fc-7wx7-m9pr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify vulnerable Smart Casa endpoint
-
DeliverySend request with serialized PHP object
-
ExploitInput reaches unserialize()
-
ExecutionPOP gadget chain triggers on destruct
-
ImpactCode execution or site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching a code path in the Smart Casa theme (versions up to and including 1.0.12) that deserializes untrusted, attacker-supplied input via PHP unserialize(). Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed. The decisive limiting factor is not stated in the description: PHP object injection only produces meaningful impact (RCE, file write, SQLi) when a reachable POP gadget chain exists in the theme, WordPress core, or an installed/active plugin - absent a usable gadget, impact may be negligible. Additional limits: the site must run an affected Smart Casa version (≤1.0.12), and the specific vulnerable endpoint must be reachable in the deployment. |
| Impact | All exploitability signals point to a high-severity, easily reachable flaw: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, unauthenticated, no-interaction PHP object injection (CWE-502) scoring 9.8 with full C:H/I:H/A:H impact. However, the severity-vs-real-risk picture is incomplete and partly inflated. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is currently no evidence of active or imminent exploitation - only theoretical exploitability. Critically, the stated C:H/I:H/A:H impact for a deserialization bug is only realized if a usable POP gadget chain exists in the theme, WordPress core, or an active plugin; raw object injection without a reachable gadget often yields limited or no practical impact, which the 9.8 does not account for. Net assessment: treat as a patch-soon issue (unauthenticated + network + CVSS 9.8 warrant prompt remediation), but this is not confirmed-exploited and its blast radius depends on the surrounding gadget landscape - it is a lower operational priority than a KEV-listed bug in a ubiquitous product. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to a Smart Casa theme endpoint that passes attacker-controlled input into a PHP unserialize() call. If a suitable POP gadget chain is present in the theme, WordPress core, or an active plugin, the injected object triggers that chain on destruction to achieve file write, SQL injection, or code execution. No public exploit code was identified at time of analysis, and realistic impact hinges on the availability of a usable gadget. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
PHP object injection in the ThemeREX Group Smart Casa WordPress theme, affecting all versions up to and including 1.0.12, lets remote attackers supply crafted serialized input to an unserialize() call without authentication (CVSS PR:N/UI:N), with the vendor/Patchstack score reaching 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Meaningful impact - remote code execution, arbitrary file write, or SQL injection - depends on a usable POP gadget chain being reachable in the theme, WordPress core, or an installed plugin, which is why our independent assessment rates the vector at AC:H despite the 9.8 base score; sites running only the theme, or with a reduced plugin set, may be far less exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but Patchstack's database entry (https://patchstack.com/database/wordpress/theme/smart-casa/vulnerability/wordpress-smart-casa-theme-1-0-12-php-object-injection-vulnerability?_s_id=cve) makes the flaw publicly documented and easily locatable by attackers.
RemediationAI
No vendor-released patch was identified at time of analysis - the description states the issue affects Smart Casa through 1.0.12 and no fixed version or vendor patch reference is present in the available intelligence, so confirm the current theme version before assuming a fix. Until a patched release appears, the highest-confidence mitigation is to deactivate and remove the Smart Casa theme from production sites (its trade-off is loss of the theme's front-end design, so stage and validate a supported alternative theme first). If removal is not feasible, restrict network access to the theme's directory and any AJAX/REST handlers it registers, for example by blocking direct requests to theme PHP files and adding WAF rules that reject serialized object payloads (strings containing O: or a: patterns passed to endpoints) - this is detection-bypassable and can break legitimate functionality, so log and tune before enforcing. Reducing gadget-chain availability also lowers real-world impact: deactivate and delete unused or abandoned plugins, keep WordPress core and all remaining plugins fully updated, and run PHP versions where the underlying framework classes are patched, accepting that this narrows rather than eliminates the primitive. Monitor the Patchstack advisory page at https://patchstack.com/database/wordpress/theme/smart-casa/vulnerability/wordpress-smart-casa-theme-1-0-12-php-object-injection-vulnerability?_s_id=cve for a fixed version, and prioritize patching on sites that cannot remove the theme; there is no confirmed active exploitation (not in CISA KEV), but the flaw is publicly documented and requires no authentication to attempt.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-502 (Deserialization of Untrusted Data) in a WordPress theme means the theme passes attacker-controllable data into PHP's unserialize() without adequate validation, allowing an attacker to instantiate arbitrary PHP objects. The CPE cpe:2.3:a:themerex_group:smart_casa:*:*:*:*:*:*:*:* identifies the affected component as the ThemeREX Group Smart Casa theme with a wildcard version, and the description bounds the vulnerable range at versions through 1.0.12. Because WordPress themes run in the same PHP process as core and every active plugin, object injection is a two-stage attack: the theme provides the injection primitive (magic methods such as __wakeup, __destruct, or __toString being reached during unserialization), and impact is realized only if a gadget chain exists somewhere in the loaded codebase - the theme itself, WordPress core, or any installed/activated plugin. The disparity between the vendor-style score (AC:L, 9.8) and our assessed vector (AC:H) reflects exactly that dependency: exploitation is network-reachable, unauthenticated, and requires no user interaction, but the outcome is conditional on gadget availability and on the specific vulnerable endpoint being reachable in the deployment, so reliability can vary substantially between targets.
Know when Smart Casa gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network/unauthenticated/no-interaction per the deserialization sink, but AC:H because practical impact depends on the existence of a reachable POP gadget chain not guaranteed in the base product.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.
Executive ViewAI
The ThemeREX Smart Casa WordPress theme, versions up to and including 1.0.12, creates a critical unauthenticated exposure for public-facing websites that use it; if a compatible gadget chain is present in the site’s plugins or core, an external attacker could achieve remote code execution, arbitrary file write, or SQL injection. Leadership should care because these sites are often customer-facing, and a compromise could lead to data theft, defacement, SEO poisoning, or broader hosting-environment compromise. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis, so risk must be managed through removal or compensating controls.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or deactivate ThemeREX Smart Casa 1.0.12 and earlier; if operationally required, apply WAF/virtual patching rules for PHP object injection and restrict untrusted access to the theme’s endpoints; reduce installed plugins to eliminate reachable POP gadget chains; and monitor for remote code execution, arbitrary file write, and SQL injection indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB