EUVD-2026-108943
GHSA-rp4f-997r-jc7c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach theme deserialization endpoint over HTTP
-
ExploitSubmit crafted serialized PHP object
-
ImpactTrigger object injection via unserialize() and gadget chain
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The advisory classifies this as PHP Object Injection via deserialization of untrusted data, so the practical prerequisite is an entry point in the Redy theme that passes attacker-supplied data to unserialize(), plus a reachable POP gadget chain (in the theme, WordPress core, or an installed plugin) to convert object instantiation into concrete impact such as file write, SQL, or code execution. The specific feature, parameter, or configuration that exposes the unserialize() call is not described in the available sources. The CVSS vector indicates no authentication and no user interaction (PR:N/UI:N), meaning no special configuration is stated as required; the main real-world limiter is the availability of a usable gadget chain, since object injection without one yields reduced impact. |
| Impact | Signals are mixed in direction but point to meaningful priority. CVSS 3.1 is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and the vuln.today decision label is act_now, both arguing for urgency. However, exploitation status is weaker than the score alone implies: there is no CISA KEV listing and no EPSS value supplied, so there is no public exploit identified at time of analysis and no probabilistic exploitation estimate to corroborate the CVSS. The core uncertainty is intrinsic to CWE-502 PHP object injection: the CVSS C:H/I:H/A:H assumes a usable POP gadget chain is reachable, but the sources do not describe the trigger or confirm a working chain, so full RCE-level impact is plausible but not evidenced. Net: treat as a real high-priority patching item because the product is unauthenticated-reachable per the advisory and deserialization flaws in WordPress themes have a strong track record of weaponization, while recognizing that the absence of KEV/EPSS/PoC means widespread active exploitation is not currently demonstrated. |
| Exploit ScenarioDerived | A remote attacker submits attacker-controlled serialized data to an entry point in the Redy theme that passes it to PHP unserialize(), instantiating arbitrary PHP objects. If a suitable property-oriented programming (gadget) chain exists in the theme, WordPress core, or active plugins, this can escalate to file operations, SQL interaction, or code execution on the site. The exact injectable parameter is not described in the available sources, and no public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 23, 2026
PHP object injection in the Axiomthemes Redy WordPress theme through version 1.3.5 lets unauthenticated remote attackers pass untrusted data into a deserialization path, rated 9.8 under the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). Whether object instantiation converts into concrete impact such as file write, SQL injection or code execution depends on a usable POP gadget chain being present in the theme, WordPress core or an installed plugin; the specific vulnerable feature, parameter or configuration is not described in the available sources. Patchstack reported the issue and the CVE org record points to its advisory, while the priority decision is act_now; no KEV listing, no confirmed public exploit code and no EPSS value were supplied, and no fixed version is listed in the available evidence.
RemediationAI
No vendor-released fixed version is identified in the available evidence, so the primary action is to check the Patchstack advisory at https://patchstack.com/database/wordpress/theme/redy/vulnerability/wordpress-redy-theme-1-3-5-php-object-injection-vulnerability?_s_id=cve for an updated Redy release and apply it as soon as one is published, then verify the installed theme version against 1.3.5 to confirm the site was exposed. If the Redy theme is not required, remove or deactivate it, since an inactive theme's code is still on disk but is not loaded into the PHP process and therefore cannot serve as the unserialize() entry point. Where the theme must stay active and no fixed release exists, the practical constraint is to reduce the attack surface around the theme's request-handling code (for example restricting access to theme-provided endpoints and any AJAX or admin-ajax handlers it registers) and to tighten the broader gadget environment by keeping WordPress core and all plugins current and removing unused ones, with the trade-off that these measures limit reachability of the injection point rather than repairing the deserialization flaw itself. Because the advisory does not identify the vulnerable parameter, blocking specific request fields is not possible from the available information.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-502 (Deserialization of Untrusted Data) in a WordPress theme context means attacker-controlled input reaches PHP's unserialize() (or an equivalent magic-method path such as __wakeup/__destruct) without adequate validation. The theme is identified by the CPE cpe:2.3:a:axiomthemes:redy:*:*:*:*:*:*:*:*, an unversioned wildcard across all Redy releases, with the advisory scoping the issue to versions from n/a through 1.3.5. Successful exploitation is a two-stage problem: first find the entry point in the theme that passes request data to the deserializer, second supply a serialized payload whose class chain (POP gadgets) exists in the loaded codebase. Because WordPress themes run alongside core and third-party plugins inside a single PHP process, gadget availability varies per installation, which is the main real-world limiter alongside any reachability constraints on the vulnerable entry point. The supplied CVSS vector states no privileges (PR:N) and no user interaction (UI:N), but it describes severity, not trigger mechanism; the trigger itself is not described in the available sources.
Know when Redy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Advisory indicates unauthenticated remote reach (AV:N/PR:N/UI:N); object injection can yield high C/I/A given a gadget chain, though the trigger is not described in sources.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.
Executive ViewAI
A critical vulnerability (CVE-2026-112855) in the Axiomthemes Redy WordPress theme (through version 1.3.5) allows unauthenticated attackers to inject PHP objects, which could lead to full site compromise if exploited with a gadget chain. Leadership should care because this affects all websites using this theme, potentially exposing sensitive data, enabling defacement, or serving as a foothold for broader network attacks.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling or removing the vulnerable theme, deploying a WAF with virtual patching rules for PHP object injection, restricting access to wp-admin and XML-RPC, and conducting regular malware scans.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB