EUVD-2026-95785
GHSA-g7x9-vgq3-cr7j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege WordPress account
-
DeliverySubmit crafted serialized payload to theme
-
ExploitTrigger unsafe PHP deserialization
-
ExecutionInstantiate gadget-chain objects
-
ImpactAchieve code execution or data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the BuddhaThemes ColorFolio theme (versions up to and including 1.3) to be installed and active on a WordPress site, and an attacker holding at least a low-privilege authenticated account (CVSS PR:L) on that site. The core deserialization flaw is remotely reachable with no user interaction, but meaningful impact (RCE, file or data compromise) is GATED on the availability of a usable PHP object-injection (POP) gadget chain in the theme, WordPress core, or another installed plugin - without such a chain, impact may be substantially reduced. Limiting factors: authentication requirement, dependence on gadget-chain presence, and the requirement that the specific vulnerable ColorFolio version be deployed. |
| Impact | CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-reachable, low-complexity PHP Object Injection flaw (CWE-502) that requires only low-privilege authentication and no user interaction, with high confidentiality, integrity, and availability impact. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there is no signal of active or probable near-term exploitation to corroborate the high base score - exploitation status is therefore 'no public exploit identified at time of analysis.' A critical caveat applies to all WordPress object-injection issues: real-world impact depends on the presence of a usable POP gadget chain in the theme, WordPress core, or co-installed plugins; the high C/I/A rating assumes such a chain is reachable, which the Patchstack record does not confirm. Net assessment: treat as a genuine patch priority for sites actually running ColorFolio (patch to beyond 1.3), but the absence of any exploitation-probability signal and the narrow/niche product footprint argue against emergency, mass-scale urgency relative to the raw 8.8. |
| Exploit ScenarioDerived | An attacker with a low-privilege authenticated account (e.g., subscriber or contributor) on a WordPress site running the ColorFolio theme ≤1.3 submits a crafted serialized PHP payload to a vulnerable theme entry point. If a suitable POP gadget chain exists in the stack, deserialization instantiates attacker-controlled objects, potentially leading to arbitrary file operations, SQL interaction, or remote code execution. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
WordPress sites running the BuddhaThemes ColorFolio theme (directory slug 'colorit') through version 1.3 expose an authenticated PHP object injection path, because the theme deserializes untrusted input without validating it (CWE-502), letting an attacker with a low-privilege account on the site supply crafted serialized data. CVSS 3.1 rates it 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the flaw is network-reachable, low-complexity, and needs no victim interaction, but full confidentiality, integrity, and availability impact is gated on the presence of a usable PHP object-injection (POP) gadget chain in the theme, WordPress core, or another installed plugin - without one the realized impact is substantially reduced. No public exploit code and no confirmed in-the-wild exploitation were identified from the available sources at time of analysis; exploitation also requires that the specific vulnerable ColorFolio version be installed and active.
RemediationAI
No vendor-released patch or fixed version is identified in the provided intelligence - the only reference is the Patchstack disclosure for ColorFolio 1.3, so the developer should be contacted or monitored for a release beyond 1.3 and any patched build should be installed as soon as it is published (search the WordPress theme repository and the vendor's channels for a version greater than 1.3). Until a fix exists, the highest-value compensating control is to deactivate and delete the ColorFolio/'colorit' theme entirely if it is not required, which removes the vulnerable code path; the trade-off is loss of the site's current presentation until a replacement theme is selected. If the theme must stay active, tightly restrict who can hold even subscriber-level accounts - disable open registration, audit existing users, remove dormant or untrusted accounts, and avoid granting roles that increase the attack surface - since CVSS PR:L means any authenticated user can reach the flaw; the trade-off is reduced site functionality and ongoing account administration. Additional hardening: apply a WAF rule that inspects POST bodies, cookies, and query parameters for serialized PHP payloads (patterns such as 'O:' followed by a digit and a class name, or base64-encoded equivalents) and blocks them, accepting the risk of false positives on legitimate serialized data; ensure WordPress core and all other plugins/themes are fully up to date so known gadget classes are removed from the process (this reduces but does not eliminate gadget availability); and log and alert on unexpected object-instantiation errors, fatal errors, or outbound requests from the web tier as an indicator that a gadget chain was exercised.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-502, Deserialization of Untrusted Data, in a PHP/WordPress context. PHP's unserialize() reconstructs objects from attacker-controlled strings; if the resulting objects have magic methods such as __wakeup(), __destruct(), or __toString() that perform filesystem, database, or network operations, an attacker can steer those operations through a chain of gadget classes ('POP chain'). The supplied CPE cpe:2.3:a:buddhathemes:colorfolio:*:*:*:*:*:*:*:* identifies the affected package as the BuddhaThemes ColorFolio WordPress theme with no version floor, consistent with the description stating impact 'from n/a through 1.3' - i.e., every released build up to and including 1.3 is in scope. Note the naming mismatch across sources: the product is ColorFolio but the WordPress theme slug is 'colorit', and the Patchstack advisory URL is filed under the theme/colorit path, so defenders should search their installations for both the display name and the directory name. Because the vulnerable code lives in a theme rather than a plugin or core, the theme must be installed and active for the code path to be reachable, and the reachable severity then depends on which other components (plugins, core, other themes) contribute gadget classes to the same PHP process.
Know when Colorfolio gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable deserialization needing only a low-privilege account (PR:L) and no interaction; object injection can yield full C/I/A compromise when a gadget chain is present.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3.
Executive ViewAI
WordPress sites running the BuddhaThemes ColorFolio theme (directory slug 'colorit') through version 1.3 face a high-severity authenticated PHP object injection risk that could allow a low-privilege user to compromise site data and availability where a usable gadget chain exists. Because exploitation requires an existing account and the vulnerable theme to be active, leadership should prioritize confirming exposure and reducing risk for affected properties. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the vulnerable ColorFolio theme (slug 'colorit') versions through 1.3 if not essential; restrict, audit, and monitor low-privilege WordPress accounts; deploy WAF/virtual patching to block serialized PHP object payloads; and monitor logs for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB