EUVD-2026-96189
GHSA-66j7-cgjc-vfw6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Edema theme ≤1.2.2.2
-
DeliveryCraft malicious serialized PHP object payload
-
ExploitSubmit payload to vulnerable deserialization sink
-
ExecutionTrigger object injection via gadget chain
-
ImpactAchieve code/data manipulation on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target site to run the ThemeREX Edema WordPress theme at a version from the earliest affected release through 1.2.2.2, and requires reaching a theme code path that deserializes attacker-controlled input via unserialize(). The decisive limiting factor for PHP Object Injection (CWE-502) is the presence of a usable POP gadget chain in the theme, its bundled libraries, or other installed plugins - without a reachable gadget, object injection alone may not yield code execution. The supplied CVSS vector asserts no privileges or user interaction (PR:N/UI:N), but this privilege level is not independently confirmed and should be verified against the Patchstack advisory, as many theme object-injection issues require at least low-privileged authenticated access. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) portrays a remote, unauthenticated, low-complexity flaw with full confidentiality, integrity and availability impact - the maximum-severity profile. However, several real-risk signals are MISSING from the provided data: no EPSS probability, no CISA KEV listing, and no public POC indicator are present in the input, so exploitation status must be read as 'no public exploit identified at time of analysis.' There is also a credible tension between the headline score and the vulnerability class: CWE-502 PHP Object Injection in WordPress themes is typically only exploitable when a suitable POP (property-oriented programming) gadget chain exists in the theme, its bundled libraries, or other installed plugins, and many Patchstack-tracked theme deserialization issues in practice require some authenticated/contributor-level access despite a PR:N vector - verify the true privilege requirement with the vendor/Patchstack advisory. Net: this is a high-severity issue worth prompt patching for sites running the Edema theme, but in the absence of KEV/EPSS/POC signals and given the niche deployment footprint it is better characterized as a latent high-severity flaw than as an actively exploited, widespread emergency. |
| Exploit ScenarioDerived | A remote attacker submits crafted, serialized PHP object data to an Edema theme endpoint that passes attacker-controlled input to unserialize(). If a usable gadget (POP) chain is present in the theme or co-installed code, the injected object's magic methods fire during destruction, letting the attacker manipulate files, data, or execution on the WordPress host. No public exploit is identified at the time of analysis, and practical impact depends on the availability of a gadget chain in the target environment. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
PHP object injection in the ThemeREX Edema WordPress theme (all releases through 1.2.2.2) lets an attacker pass crafted serialized data into an unserialize() call in the theme code, instantiating arbitrary PHP objects and - if a usable POP gadget chain exists in the theme, its bundled libraries, or another installed plugin - escalating to full site compromise. The advisory vector scores this 9.8 (network, low complexity, no privileges, no user interaction), but our independent assessment rates it complexity-high with low privileges required and flags the claimed unauthenticated path as unconfirmed, since many WordPress theme object-injection bugs need at least a low-privileged authenticated user; practical impact therefore hinges on gadget-chain availability rather than the raw CVSS number. No public exploit code and no confirmed active exploitation were identified at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis, so the only fully effective step is to remove the ThemeREX Edema theme from the filesystem, which eliminates the vulnerable unserialize() code path entirely but means the site loses the theme's design and any theme-dependent functionality; deactivating the theme without deleting it is a partial measure, since deactivated theme files are not normally executed on front-end requests, yet the code remains on disk and can be reactivated by an administrator or revived by any bug that loads it. If the theme must stay live while a fix is awaited, apply Patchstack virtual patching (which intercepts the malicious serialized payload at the request layer) and add WAF rules that reject serialized PHP object strings (patterns containing O: followed by a class name and colon-delimited length, or C: for Serializable) in theme-facing parameters, accepting the trade-off of possible false positives on legitimate serialized input. Because exploitation depends on a reachable POP gadget chain, reducing the installed plugin/library surface on the site lowers the probability of a usable chain but is not a reliable substitute for removal. Monitor the Patchstack theme advisory at https://patchstack.com/database/wordpress/theme/edema/vulnerability/wordpress-edema-theme-1-2-2-2-php-object-injection-vulnerability?_s_id=cve for a patched release, and upgrade to the first fixed version as soon as it is published; until then, restrict access to low-trust accounts and review logs for serialized object payloads aimed at theme endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-502, Deserialization of Untrusted Data, in a WordPress theme distributed by ThemeREX Group and tracked by CPE cpe:2.3:a:themerex_group:edema:*:*:*:*:*:*:*:*. PHP's unserialize() reconstructs objects from attacker-supplied strings and triggers magic methods such as __wakeup(), __destruct() and __toString() during reconstruction or garbage collection; the danger is not the object creation itself but the method calls it provokes. A successful exploit typically requires a Property-Oriented Programming (POP) gadget chain: a sequence of classes whose magic methods chain into a dangerous sink such as file write or eval(). Because the vulnerable code lives in a theme, the reachable gadget surface is the theme's own classes plus any bundled libraries and co-installed plugins, which is why two otherwise identical sites can have very different exploitability. The supplied vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) and our assessed vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) agree on network reachability and full confidentiality, integrity and availability impact with changed scope absent (S:U), meaning the attacker is not claimed to escape the application's security authority; they diverge on attack complexity (real vs. theoretical gadget availability) and required privilege (PR:L, an unverified assumption in the vendor-supplied data). Patchstack, which reported the issue, tracks it as a WordPress Edema theme PHP Object Injection and publishes a per-theme advisory URL of the form https://patchstack.com/database/wordpress/theme/edema/vulnerability/wordpress-edema-theme-1-2-2-2-php-object-injection-vulnerability.
Know when Edema gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Object injection is network-reachable but needs a POP gadget chain (AC:H) and realistically some authenticated access typical of theme sinks (PR:L); full C/I/A impact retained.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.
Executive ViewAI
The ThemeREX Edema WordPress theme, used by organizations to host public-facing websites, contains a critical PHP object injection vulnerability affecting all versions through 1.2.2.2. Although no public exploit or active exploitation has been identified at time of analysis, and no vendor-released patch is available, successful exploitation could lead to full site compromise, impacting website integrity, data confidentiality, and customer trust. Leadership should prioritize immediate mitigation because the risk, while dependent on the presence of a usable gadget chain, requires urgent attention given the absence of a patch.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling the ThemeREX Edema theme, implementing WAF rules to block PHP object injection attempts, restricting user privileges, monitoring for suspicious activity, and evaluating alternative themes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB