EUVD-2026-95784
GHSA-c64r-rv52-45v4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged WordPress user
-
ExploitSubmit crafted serialized PHP object
-
ExecutionTrigger object injection in theme sink
-
ImpactExecute gadget chain for code execution / site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session on the target WordPress site (CVSS PR:L - at least a low-privileged account such as subscriber/contributor, obtainable via open registration on many sites), after which a crafted serialized PHP object is delivered to the theme's vulnerable deserialization routine. Successful code execution further depends on the presence of a usable POP gadget chain in the Neo | Barber Shop theme (versions up to and including 3.5) or in co-installed plugins/core; absent a viable gadget chain the impact may be limited to object instantiation. Limiting factors: the required authentication level, the niche deployment of this specific theme, and gadget-chain availability. |
| Impact | This is a genuine high-priority issue but short of critical-emergency status. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity exploitation with full CIA impact, but PR:L means an attacker must first hold at least a low-privileged authenticated account (e.g., a subscriber/contributor WordPress account), which materially lowers real-world risk versus a fully unauthenticated RCE. CWE-502 PHP Object Injection via deserialization can escalate to remote code execution or full site takeover when a usable gadget chain is present. No EPSS score, no CISA KEV listing, and no public POC are provided in the input, so there is no evidence of active exploitation - exploitation probability signals are simply absent rather than confirmed low. The single source is a Patchstack advisory, a reputable WordPress-vulnerability vendor. Net: treat as a high-severity patch-soon item for sites running this theme, not a confirmed in-the-wild emergency; the authentication requirement and the limited deployment footprint of a niche barber-shop theme temper the raw 8.8 score. |
| Exploit ScenarioDerived | An attacker who holds or registers a low-privileged account on a WordPress site running the Neo | Barber Shop theme submits a crafted request containing a malicious serialized PHP object to a vulnerable deserialization sink. If a suitable gadget chain exists in the theme or loaded plugins, this triggers PHP Object Injection leading to code execution, data disclosure, or site compromise. No public exploit code is identified at time of analysis, so exploitation would currently require the attacker to develop their own payload and gadget chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
PHP object injection in the BuddhaThemes Neo | Barber Shop WordPress theme (slug neocut), affecting all versions through 3.5, lets an authenticated attacker with a low-privileged account (subscriber or contributor level) deliver a crafted serialized PHP object to the theme's unsafe deserialization routine, potentially reaching high confidentiality, integrity and availability impact if a usable POP gadget chain exists. The issue carries CVSS 8.8 via vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and no public exploit code has been identified at time of analysis (no CISA KEV listing). Because the required authentication level, the niche deployment of this specific theme, and the dependence on gadget-chain availability all limit practical exploitation, this is a genuine high-priority issue but short of critical-emergency status.
RemediationAI
No vendor-released patch is identified in the available data for CVE-2026-94064, so the exact fixed version cannot be confirmed here; consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/neocut/vulnerability/wordpress-neo-barber-shop-wordpress-theme-theme-3-5-php-object-injection-vulnerability?_s_id=cve) for a patched release and apply it as soon as one is published. Because exploitation requires a low-privileged authenticated session (CVSS PR:L), the most effective compensating controls are to close open registration and tighten role assignment on affected sites so subscriber or contributor accounts cannot be self-provisioned, and to disable or uninstall the Neo | Barber Shop theme if it is not actively in use; the first can break legitimate community features and the second removes the site's design. A WAF rule or Patchstack vPatch tuned to block serialized PHP object payloads in theme requests can serve as an interim measure but may cause false positives on legitimate serialized data and should be tested before enforcement. If a POP gadget chain is found to reside only in co-installed plugins or WordPress core, updating those components is also required to remove the prerequisite for code execution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a PHP Object Injection issue (CWE-502) in which the theme feeds attacker-controllable input into PHP's unserialize() or an equivalent deserialization sink without adequate validation, allowing a crafted serialized string to be instantiated as arbitrary PHP objects. In WordPress themes and plugins, exploitation of this class typically relies on magic methods such as __wakeup, __destruct or __toString chained through a Property-Oriented Programming (POP) gadget chain that can bridge object instantiation to dangerous operations like file writes or command execution. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity flaw requiring a low-privileged authenticated session and no user interaction, with high impact on confidentiality, integrity and availability when exploitation succeeds. The CPE cpe:2.3:a:buddhathemes:neo_|_barber_shop_wordpress_theme:*:*:*:*:*:*:*:* identifies the affected product family as the BuddhaThemes Neo | Barber Shop theme; per the independent assessment, the realized severity depends on whether a usable gadget chain exists within the theme itself or in co-installed plugins or WordPress core, and absent such a chain the impact may be limited to object instantiation.
Know when Wordpress Theme gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable deserialization needing a low-privileged authenticated WordPress account (PR:L), no user interaction, with object injection enabling full code execution and thus high C/I/A.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5.
Executive ViewAI
BuddhaThemes Neo | Barber Shop WordPress theme (slug neocut) versions through 3.5 presents a high-severity PHP object injection risk that could allow an authenticated low-privileged user to compromise site confidentiality, integrity, and availability if a usable gadget chain is present. Organizations using this niche theme should treat affected sites as exposed to a serious but not emergency-level threat, particularly where subscriber or contributor accounts are broadly available. Leadership should care because exploitation could lead to data exposure, site tampering, or downtime, with remediation complicated because no vendor-released patch was identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include removing or disabling the BuddhaThemes Neo | Barber Shop theme (slug neocut) on all versions through 3.5, restricting subscriber/contributor accounts, disabling open registration, applying WAF/virtual patching for PHP object injection, monitoring for serialized object payloads, and replacing the theme with a maintained alternative until a vendor patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
More in Wordpress Theme
View allThe Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the news
The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and in
A vulnerability in posimyththemes Nexter nexter.0.3. Rated high severity (CVSS 8.5), this vulnerability is remotely expl
The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Acti
Remote code execution in the dmcwebzone Airin Blog WordPress plugin (versions up to and including 1.6.1) is possible thr
Unauthenticated arbitrary file upload in the Clanora WordPress theme (versions before 1.3.1) allows remote attackers to
search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS. Rated medium severity (CVSS 6.1), thi
Arbitrary file upload in the CMSSuperHeroes Wastia WordPress theme (all versions before 1.1.3) allows remote attackers t
Unauthenticated arbitrary file upload in the Doctreat WordPress theme (versions up to and including 1.7.0) allows remote
Unrestricted Upload of File with Dangerous Type vulnerability in EPC AI Hub allows Upload a Web Shell to a Web Server.3.
Backdoor / malicious code implant in the Silk Themes 'Newspapers X' WordPress theme (versions 1.0.46 through 1.0.48) all
Critical unrestricted file upload vulnerability in NasaTheme Flozen that allows unauthenticated remote attackers to uplo
Exploit-DB