EUVD-2026-96190
GHSA-qw9w-57w4-24pf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Greeny theme ≤2.10.0
-
DeliveryCraft malicious serialized PHP payload
-
ExploitSubmit to vulnerable deserialization endpoint
-
ExecutionTrigger object injection via unserialize()
-
PersistChain POP gadget for code execution
-
ImpactCompromise site data or server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Greeny WordPress theme (ThemeREX Group) at version 2.10.0 or earlier to be installed and active, and an attacker-reachable code path that passes untrusted input into PHP unserialize(). Successful impact (RCE/file/data compromise) additionally depends on a usable POP gadget chain being present in the theme, WordPress core, or another active plugin - without such a chain the object injection may be inert. The provided CVSS marks the flaw as unauthenticated (PR:N) with no user interaction (UI:N), but the specific vulnerable endpoint and whether authentication is actually required are not confirmed in the available data. |
| Impact | The input signals are partially aligned but incomplete. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical) describes a remote, unauthenticated, low-complexity flaw with full confidentiality/integrity/availability impact - consistent with CWE-502 PHP Object Injection that can escalate to code execution or data compromise when an exploitable POP gadget chain exists in the theme or a co-located plugin. However, no EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or imminent exploitation - this is a high-CVSS rating without corroborating real-world exploitation signals. A key caveat: object-injection impact is conditional on a reachable gadget chain, so the C:H/I:H/A:H and AC:L assigned by the reporting source (Patchstack) may be optimistic for a worst case rather than confirmed; absent a demonstrated exploit, the practical severity could be lower than 9.8. Prioritize patching because the product is a WordPress theme (internet-facing by nature) and the CVSS marks it unauthenticated, but treat the 'critical' label as vendor-assigned and not yet validated by exploitation telemetry. |
| Exploit ScenarioDerived | A remote attacker submits crafted, serialized PHP data to an endpoint in the Greeny theme that passes untrusted input to unserialize(), instantiating attacker-chosen objects. If a suitable POP gadget chain is present in the theme, WordPress core, or an active plugin, the magic methods triggered during deserialization can lead to file writes, SQL injection, or remote code execution. No public exploit code is identified at time of analysis, so weaponization would require the attacker to build or source a working gadget chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
PHP object injection in the Greeny WordPress theme (ThemeREX Group) through version 2.10.0 allows remote attackers to feed crafted serialized data into an unsafe PHP unserialize() call, leading to arbitrary object instantiation and - where a usable POP gadget chain exists in the theme, WordPress core, or another active plugin - code execution or full site compromise. The published scoring rates this 9.8 with network vector, no privileges (PR:N), and no user interaction (UI:N), but the specific vulnerable endpoint and whether authentication is genuinely required are not confirmed by the available data, and our independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) precisely because exploitation hinges on a gadget chain being present rather than on the injection alone. There is no public exploit identified at time of analysis and no CISA KEV listing for this issue.
RemediationAI
No vendor-released patch version is identified in the available data; the Patchstack advisory (https://patchstack.com/database/wordpress/theme/greeny/vulnerability/wordpress-greeny-theme-2-10-0-php-object-injection-vulnerability?_s_id=cve) is the only reference provided, and administrators should check the ThemeREX Group distribution channel for a Greeny release above 2.10.0 before assuming a fix exists. If no fixed build is available, the highest-confidence mitigation is to stop running the vulnerable theme: switch the active theme to a maintained default such as a current WordPress core theme and remove or quarantine the greeny directory, accepting the trade-off that the site loses its Greeny layout and styling until a patched release ships. Isolating rather than deleting the theme directory is not a reliable control, since any remaining code path that reaches unserialize() can still be invoked. Enforce a WAF rule that inspects request bodies, cookies, and parameters for PHP serialization markers such as 'O:' followed by a digit and ':' sequence and blocks or logs them, understanding that this can produce false positives on legitimate serialized payloads and does not cover non-HTTP entry points. As defense in depth against the gadget-chain precondition, keep WordPress core and every active plugin on current releases and deactivate unused plugins and themes, which removes classes an attacker could chain; run PHP 8.x where feasible, since newer engines change serialization internals but do not by themselves fix an unsafe unserialize() call. Finally, monitor logs and file-integrity tooling for unexpected object-injection attempts and for post-exploitation writes in wp-content, and restrict administrative and REST access by IP where operationally possible.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-502, Deserialization of Untrusted Data, in the PHP code shipped by a WordPress theme. PHP's unserialize() reconstructs live objects from a string supplied by the caller; when attacker-controlled input reaches it, the attacker controls which classes are instantiated and with what property values. PHP invokes magic methods such as __wakeup(), __destruct(), and __toString() during or after reconstruction, so a chain of otherwise benign classes (a POP/property-oriented-programming gadget chain) can be stitched together to reach dangerous sinks like file writes, eval, or arbitrary method calls. Two conditions therefore gate real impact: the untrusted input must actually reach unserialize() through an attacker-reachable request path, and at least one exploitable gadget chain must be loadable - typically in the theme itself, WordPress core, or any other active plugin. The affected component is identified by the CPE cpe:2.3:a:themerex_group:greeny:*:*:*:*:*:*:*:*, a wildcard covering all versions of the ThemeREX Group Greeny theme, while the advisory text scopes the flaw to releases through 2.10.0. Because themes run in the same PHP process as WordPress and its plugins, the practical gadget surface is the entire installed codebase, which is why the flaw is rated High on confidentiality, integrity, and availability even though the injection primitive alone may be inert on a hardened stack.
Know when Greeny gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated per reported vector, but object-injection impact hinges on a reachable POP gadget chain, so AC:H rather than the reporter's AC:L; full C/I/A assumed for a successful chain.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.
Executive ViewAI
The Greeny WordPress theme (ThemeREX Group), through version 2.10.0, carries a critical object injection flaw that could allow an unauthenticated remote attacker to instantiate arbitrary PHP objects and, if a suitable gadget chain exists anywhere in the site's codebase, achieve code execution and full site compromise. Because the vendor has not released a fix, every website still running this theme remains exposed, putting hosted content, customer data, and any e-commerce or lead-generation functionality tied to those sites at risk. Leadership should treat this as an unpatched, internet-facing exposure requiring immediate inventory and remediation decisions rather than routine update scheduling.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or deactivate the Greeny theme where it is not actively required; otherwise restrict public access to the theme's PHP endpoints and deploy WAF/virtual-patching rules that reject crafted serialized data; audit active plugins and WordPress core to determine whether a usable POP gadget chain is present; disable unused PHP magic methods where operationally feasible; monitor wp-content/themes and wp-content/plugins for unauthorized file changes and review web logs for serialized payload attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB