Axiomthemes Rhodos EUVD-2026-108945

The description states only that Rhodos (through 1.3.3) deserializes untrusted data allowing PHP object injection; it does not name the specific parameter, endpoint, feature, or configuration that reaches the unserialize() sink, so the exact trigger is not described in the available sources. Successful impact beyond the injection itself additionally requires a usable POP gadget chain to be present and loadable in the theme or co-installed plugins - a limiting factor the sources do not confirm. The site must be running the Rhodos theme at version 1.3.3 or earlier. The CVSS vector indicates PR:N/UI:N (no authentication or user interaction required per the supplied metrics), but authentication requirements are not independently detailed in the description text.

The input presents a uniformly severe picture on paper: CVSS 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N (network, low complexity, no privileges, no user interaction, high confidentiality/integrity/availability impact), a CWE-502 deserialization/PHP object injection weakness, and a vuln.today Decision label of 'act_now' from a Patchstack report. However, several real-world risk signals are MISSING and must not be presented as present: no EPSS exploitation-probability score is supplied, this CVE is NOT listed in CISA KEV (no KEV=YES in input), and no proof-of-concept or exploit reference is provided - the single reference is a Patchstack vulnerability-database advisory entry, not exploit code. A critical caveat for CWE-502 object injection: the CVSS vector assumes full C/I/A impact, but PHP object injection is only exploitable to code execution or data impact when a usable POP (property-oriented programming) gadget chain is reachable in the theme or its loaded dependencies; the available sources do not confirm such a chain exists or how the sink is reached, so the 9.8 should be treated as a worst-case severity rating rather than demonstrated end-to-end impact. The 'act_now' label is driven primarily by the critical CVSS and the AV:N/PR:N profile rather than by confirmed exploitation. Net: prioritize patching because the theoretical severity and exposure are high and the vendor flags it urgent, but recognize that without EPSS, KEV, or a verified PoC, the evidence for active or imminent widespread exploitation is weak, and the affected product is a niche WordPress theme with a limited footprint.

A remote attacker sends a crafted request to a WordPress site running the Rhodos theme (≤1.3.3) containing a malicious serialized PHP object that reaches an unsafe unserialize() call. If a suitable POP gadget chain is present in the theme or loaded plugins, the injected object triggers that chain on instantiation, potentially leading to data tampering, file operations, or code execution in the site's PHP context. No public exploit code is identified in the provided sources, and the exact request/parameter that triggers the deserialization is not described in the available evidence.