EUVD-2026-96191
GHSA-g3qq-hrvj-4p9x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress site over network
-
DeliverySend crafted serialized PHP object
-
ExploitTrigger unsafe deserialization in theme
-
ExecutionInstantiate POP gadget chain
-
ImpactAchieve code or data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the Hogwords WordPress theme (versions up to and including 1.2.7) at any endpoint that passes attacker-controlled data to a PHP deserialization routine (e.g., unserialize()). Per the supplied vector (AV:N/AC:L/PR:N/UI:N), no authentication or user interaction is required and it is remotely reachable against default installs that have the theme active. The key LIMITING factor is that meaningful impact (RCE/file/DB compromise) requires a usable POP gadget chain to be present in the theme, WordPress core, or an active plugin; without such a chain the object injection may be inert. Exploitation also requires the vulnerable theme to be installed and active on the target site. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a remotely reachable, unauthenticated PHP Object Injection flaw (CWE-502) requiring no user interaction - a profile that normally warrants urgent prioritization. However, several real-risk signals are missing: no EPSS score was provided, the vulnerability is NOT listed in CISA KEV, and no public POC/exploit code is referenced (the sole reference is the Patchstack advisory). The most important technical caveat is inherent to PHP Object Injection: the maximum C/I/A:H impact is only realizable if a usable POP (property-oriented programming) gadget chain is present in the theme, WordPress core, or an active plugin - if no gadget chain exists, practical impact can be far lower than the 9.8 implies. This is therefore a genuinely high-severity, easy-to-reach deserialization bug that merits prompt patching, but in the absence of KEV/EPSS/POC evidence it currently reads as a high-CVSS issue with no confirmed active exploitation, where realized impact is gadget-chain-dependent - verify exploitability against your specific WordPress stack. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request containing a malicious serialized PHP object to a Hogwords theme endpoint that unsafely deserializes user-controlled input. If a suitable POP gadget chain is reachable in the theme, WordPress core, or an installed plugin, the injected object triggers that chain on instantiation, leading to outcomes such as arbitrary file operations, SQL injection, or remote code execution. No public exploit code was identified in the provided data, and successful impact depends on an available gadget chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
PHP object injection in the ThemeREX Group Hogwords WordPress theme (all versions through 1.2.7) lets remote attackers supply crafted serialized input to a PHP deserialization routine, which is assessed as unauthenticated and requiring no user interaction (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and can lead to full confidentiality, integrity, and availability loss if a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. The vulnerable theme must be installed and active and the attack surface is any endpoint that passes attacker-controlled data into unserialize()/unserialize-like handling. At time of analysis there is no public exploit identified and no CISA KEV listing, so the practical risk is bounded by the availability of a working gadget chain rather than by demonstrated exploitation; Patchstack reported the issue and no fixed theme version is stated in the supplied data.
RemediationAI
No vendor-released patch or fixed version is identified in the supplied data (the advisory cites only "through 1.2.7" without a patched release), so the primary action is to check the Patchstack advisory at https://patchstack.com/database/wordpress/theme/hogwords/vulnerability/wordpress-hogwords-theme-1-2-7-php-object-injection-vulnerability?_s_id=cve and the ThemeREX vendor channel for an updated Hogwords build and upgrade to the first release that addresses CVE-2026-93938 as soon as it is published. Until then, deactivate and delete the theme if it is not business-critical - an immediate fix with no residual exposure but a loss of site presentation; if the theme must remain, apply virtual patching at the WAF or reverse proxy that rejects request parameters, cookies, and POST bodies containing PHP serialization markers (notably O: and C: object payloads) reaching the theme's endpoints, accepting that such rules can produce false positives on legitimate serialized data and are evadable via encoding. Reduce the available gadget surface by keeping WordPress core and all active plugins fully patched and by removing unused or abandoned plugins, understanding this lowers but does not eliminate the risk of a usable chain. Restrict administrative and theme-editor access to trusted networks and monitor logs for serialized payloads, anomalous 500 responses, or unexpected file creation as compensating detection while a fix is pending.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-502 (Deserialization of Untrusted Data) in the Hogwords WordPress theme distributed by ThemeREX Group; the CPE string cpe:2.3:a:themerex_group:hogwords:*:*:*:*:*:*:*:* confirms the affected component is the theme itself and that the version wildcard covers all releases up to and including 1.2.7. PHP object injection occurs when attacker-controlled input reaches unserialize(), allowing an attacker to instantiate arbitrary classes present in the runtime. On its own, object instantiation is usually inert; exploitation requires a property-oriented programming (POP) gadget chain - classes with magic methods such as __wakeup(), __destruct(), __toString(), or __call() - that chain into a dangerous sink such as file write, arbitrary file deletion, SQL execution, or command execution. In a WordPress context those gadgets are typically supplied by WordPress core, the active theme, and installed plugins, which is why the real-world impact of this CVE varies from site to site. Because the assessed vector is AV:N/AC:L/PR:N/UI:N, exploitation is network-reachable against default installations without credentials or victim interaction, but it also depends on the theme being installed and active and on the presence of a compatible chain in the loaded codebase.
Know when Hogwords gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote deserialization (AV:N/AC:L/PR:N/UI:N); full C/I/A:H retained assuming a reachable POP gadget chain, consistent with the reported vector.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.
Executive ViewAI
The ThemeREX Group Hogwords WordPress theme, in all versions through 1.2.7, contains a critical flaw that would let an unauthenticated attacker who can reach an affected site's endpoints potentially gain full control of the site, with no credentials or user interaction required. Any business unit or brand hosting a WordPress site with this theme active is exposed, and a successful compromise could mean loss of site content, customer-facing services, and any data the site handles, plus a possible foothold into the surrounding hosting environment. There is no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, so the near-term priority is identifying exposed sites and removing the attack surface while a fix is pending.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the vulnerable Hogwords theme (versions through 1.2.7) wherever it is not business-essential; front affected sites with a WAF or virtual patching rule that blocks crafted serialized input to theme endpoints; reduce available gadget chains by deleting unused plugins and themes; restrict administrative and endpoint access to trusted IP ranges; enable file integrity monitoring and alerting for deserialization abuse; and rotate credentials and secrets in case of undetected access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB