EUVD-2026-96196
GHSA-fgvq-8q7m-978c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted serialized payload to theme endpoint
-
DeliveryPayload reaches unserialize() sink
-
ExploitPHP object injection instantiates attacker-controlled object
-
ExecutionPOP gadget chain triggered
-
ImpactArbitrary code or file operations on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker-reachable input in the Rosalinda theme (versions up to and including 1.2.4) that is passed to PHP unserialize(), AND - for meaningful impact - the presence of a usable POP gadget chain in the theme, WordPress core, or an installed plugin; the deserialization primitive alone is inert without such a chain. The CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is required to reach the sink, but the advisory does not name the specific endpoint or parameter, and no fixed version is listed ('from n/a through 1.2.4'), so all deployments of the theme at or below 1.2.4 should be considered affected. The primary limiting factor is gadget-chain availability rather than access level. |
| Impact | The input assigns a CRITICAL CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity and availability impact. However, several real-world risk signals are MISSING: no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no confirmed evidence of active or imminent exploitation. Critically, this is a PHP Object Injection / deserialization flaw (CWE-502): raw CVSS treats object injection as trivially code-executing, but practical exploitation almost always depends on the presence of a usable POP (property-oriented programming) gadget chain in the theme, WordPress core, or loaded plugins - the advisory does not confirm a working gadget chain exists. Therefore the 9.8 likely represents worst-case potential rather than demonstrated end-to-end impact, and real-world priority should be treated as HIGH-potential-but-UNVERIFIED pending confirmation of an exploitable gadget chain and the attacker-controlled input path. Verify the injection sink and available gadgets with Patchstack before treating this as a confirmed unauthenticated RCE. |
| Exploit ScenarioDerived | A remote attacker submits a crafted serialized PHP payload to a Rosalinda theme input that is passed to unserialize(), triggering object injection. If a suitable POP gadget chain is present in the theme or surrounding WordPress stack, this can escalate to arbitrary file operations, SQL interaction, or code execution. No public exploit code was identified at time of analysis, and successful exploitation is contingent on an available gadget chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in the ThemeREX Group Rosalinda WordPress theme, affecting all versions through 1.2.4, lets remote attackers reach an unserialize() sink and inject arbitrary PHP objects. The reported CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), though independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because meaningful exploitation additionally requires a usable POP gadget chain in the theme, WordPress core, or an installed plugin; the deserialization primitive alone is inert without one. The CVSS vector confirms no authentication or user interaction is needed to reach the sink, and while the advisory does not name the specific endpoint or parameter, no public exploit code has been identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis: the advisory lists the affected range only as 'from n/a through 1.2.4' and names no fixed version, so there is no authoritative upgrade target to cite. Because the vulnerable code lives entirely in the theme, the most effective immediate control is to deactivate and remove Rosalinda and migrate to a maintained alternative theme - the trade-off is loss of the site's current presentation layer and the need to rebuild templates and customizations. If the theme must stay live temporarily, reduce exposure by fronting the site with a WAF or reverse proxy rule that blocks serialized-object payloads (patterns such as O: and a: with class names) on theme-handling request paths, accepting the risk of false positives against legitimate serialized form or option data. Additional layered controls include restricting access to any theme-provided AJAX, REST, or admin-post endpoints to authenticated users where the theme permits it, keeping WordPress core and all plugins fully updated to shrink the available POP gadget surface (since the vulnerability becomes exploitable only when a usable chain exists), and deploying a WordPress-aware runtime or integrity monitor to alert on unexpected object instantiation. None of these compensating controls fix the underlying unserialize() sink; they only reduce the probability that an attacker can reach it with a working gadget chain.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-502 Deserialization of Untrusted Data issue in the Rosalinda WordPress theme distributed by ThemeREX Group. The theme passes attacker-influenceable input into PHP's unserialize() function, allowing an attacker to supply a crafted serialized string that PHP reconstructs into attacker-controlled objects. Impact depends on magic methods (__wakeup, __destruct, __toString) implemented by classes autoloaded in the WordPress process: when such a class is reachable, the injected object can be chained into a Property-Oriented Programming (POP) gadget chain that pivots from the deserialization primitive to file operations, SQL queries, or code execution. The CPE cpe:2.3:a:themerex_group:rosalinda:*:*:*:*:*:*:*:* uses a wildcard version, so every release at or below 1.2.4 is in scope; the advisory listing 'from n/a through 1.2.4' provides no lower bound. The plugin-heavy WordPress ecosystem typically supplies a broad gadget surface, which is why these issues are rated critical even though a successful chain is environment-dependent.
Know when Rosalinda gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated (AV:N/PR:N/UI:N), but AC:H because practical impact depends on an available POP gadget chain; high C/I/A if that chain enables code execution.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.
Executive ViewAI
The ThemeREX Group Rosalinda WordPress theme (all versions through 1.2.4) presents a critical unauthenticated PHP object injection risk that could allow attackers to compromise affected websites. While no public exploit identified at time of analysis, the lack of a vendor-released patch (no vendor-released patch identified at time of analysis) leaves organizations exposed. Leadership should act because a successful exploit could lead to data breaches, site defacement, or full server takeover.
Disable the vulnerable theme; implement WAF rules to block PHP object injection; restrict access to theme files and endpoints; remove unused plugins to reduce gadget chains; monitor for suspicious activity; and consider virtual patching from a security vendor. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB