EUVD-2026-112949
GHSA-3mrq-9m93-28r2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach vulnerable Quirky endpoint (AV:N, PR:N)
-
DeliverySubmit crafted serialized PHP payload
-
ExploitTrigger object injection via unsafe deserialization
-
ExecutionInvoke POP gadget chain
-
ImpactAchieve code execution or data compromise on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication required per the input CVSS vector (PR:N, AV:N, UI:N): a remote, unauthenticated attacker can reach the flaw in ThemeRex Quirky theme versions 1.23 and earlier. The CVE describes unauthenticated PHP Object Injection but does not name the exact parameter, endpoint, or feature that deserializes attacker input - the trigger is not described in the available sources. Practical impact is LIMITED by the need for a reachable POP gadget chain (in the theme, WordPress core, or an installed plugin) to convert object injection into code execution or file operations; without such a chain the outcome may be reduced. Exploitation is further bounded to sites running the Quirky theme at version <= 1.23. |
| Impact | Multiple signals point the same direction but rest on a single source. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 CRITICAL) describes a network-reachable, low-complexity flaw needing no privileges or user interaction, and the vuln.today Decision label is act_now - so treatment should be urgent, not deferred. CWE-502 deserialization (PHP Object Injection) reaching unauthenticated users is a classic high-impact pattern. However, the real-world impact of a PHP Object Injection hinges on a usable POP gadget chain being reachable in the theme, WordPress core, or an installed plugin; the description does not state the trigger or confirm a working chain, so the full C:H/I:H/A:H outcome is plausible but not demonstrated in the available evidence. EPSS is NOT provided, so exploitation probability cannot be quantified. KEV status is NOT present (not listed), and no PoC or exploit reference is supplied - only a Patchstack database advisory. Net: this is a genuine high-priority item given act_now plus an unauthenticated network vector, but the urgency rests solely on Patchstack's single advisory with no EPSS, no KEV, and no demonstrated exploit to corroborate it. |
| Exploit ScenarioDerived | A remote attacker with no account sends crafted input to the Quirky theme that is deserialized by PHP, instantiating attacker-controlled objects. If a suitable POP gadget chain exists in the theme, WordPress core, or an active plugin, this can escalate to file operations or code execution on the site. No public exploit or PoC is identified in the provided data, and the exact injectable parameter is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
Unauthenticated PHP object injection affects the ThemeRex Quirky WordPress theme through version 1.23, with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A remote attacker can reach the flaw without authentication, but the vulnerable parameter and endpoint are not identified in the available sources, and meaningful compromise depends on a usable POP gadget chain in the theme, WordPress core, or an installed plugin. No public exploit or confirmed active exploitation was identified at time of analysis, and the provided priority label is act_now.
RemediationAI
No fixed version is listed in the provided data, so no exact vendor patch version can be cited; check the referenced Patchstack advisory for an updated Quirky release and apply it when published. Until a fixed theme version is available, the most direct compensating control is to deactivate and remove the Quirky theme from exposed sites and switch to a maintained theme; the trade-off is loss of the theme's layout and styling and possible content or display changes. Because the vulnerable parameter and endpoint are not identified, request-filtering or WAF rules cannot be scoped precisely to this flaw, and generic serialized-object signatures are only a partial, error-prone mitigation. Restricting administrative access does not address the unauthenticated vector.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-502 (Deserialization of Untrusted Data) is the underlying weakness class for CVE-2026-54857. The affected package is the ThemeRex Quirky WordPress theme, represented by CPE cpe:2.3:a:themerex:quirky:*:*:*:*:*:*:*:* and reported for versions 1.23 and earlier. PHP object injection occurs when attacker-controlled serialized data reaches a deserialization sink such as unserialize(), allowing object properties to be influenced; converting object injection into code execution, file operations, or other high-impact outcomes requires magic methods and a reachable POP gadget chain. The supplied sources do not state the vulnerable parameter, hook, AJAX action, REST route, or template path, so the trigger is not described in the available sources. The assessed vector is network-reachable, low complexity, unauthenticated, and requires no user interaction, with high confidentiality, integrity, and availability impact if a usable gadget chain exists.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization (AV:N/AC:L/PR:N/UI:N); high C/I/A retained in line with PHP object injection potential, though full impact depends on an available gadget chain.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
Articles & Coverage 1
Executive ViewAI
The ThemeRex Quirky WordPress theme (through version 1.23) contains a critical unauthenticated PHP object injection vulnerability. Any unauthenticated remote attacker could potentially compromise the confidentiality, integrity, and availability of the website, depending on the presence of a usable POP gadget chain in the theme, WordPress core, or installed plugins. Leadership should care because this affects the organization's public-facing web presence, potentially leading to data breach, website defacement, or operational disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or remove the vulnerable theme, use a WAF to filter malicious requests, restrict access to the site (e.g., IP whitelisting), and ensure all other components (core, plugins) are up to date to minimize gadget chain availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB