ThemeREX Preservation EUVD-2026-112951

Exploitation requires a WordPress installation running the ThemeREX Preservation theme at version 1.15 or earlier; the CVSS PR:N/UI:N metrics indicate no authentication or user interaction is needed against such a target. The practical limiting factor is that PHP Object Injection (CWE-502) typically requires a usable gadget chain in the theme, WordPress core, or an installed plugin to escalate beyond object instantiation to meaningful impact; the available sources do not confirm which endpoint or parameter accepts the serialized input, nor whether a gadget chain is present by default. Real-world reach is further bounded by the theme's limited deployment footprint.

Multiple signals align toward genuine priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity flaw requiring no privileges and no user interaction, yielding full confidentiality, integrity, and availability impact (C:H/I:H/A:H) for a 9.8 score - consistent with CWE-502 deserialization leading to PHP Object Injection. The vuln.today decision label is 'act_now', reinforcing high urgency. However, several corroborating signals are absent: no EPSS exploitation-probability score is provided, the CVE is NOT on the CISA KEV list, and no confirmed working exploit code is indicated - the sole reference is the Patchstack advisory, not a published PoC. The practical impact of PHP Object Injection is heavily gated by whether a usable gadget chain exists in the theme or its loaded WordPress/plugin ecosystem, which the available data does not establish. Net: the CVSS and vendor priority flag justify prompt remediation, but the real-world exploitation signals (no KEV, no EPSS, no verified PoC) suggest this is a theoretically high-severity issue awaiting demonstrated weaponization rather than confirmed active abuse. Exploitability also depends on real-world deployment, which is limited for this specific theme.

A remote, unauthenticated attacker sends a crafted request to a WordPress site running the Preservation theme (<= 1.15), supplying attacker-controlled serialized PHP data to a vulnerable entry point. If a suitable gadget chain is reachable in the theme, WordPress core, or an installed plugin, deserialization triggers object instantiation that can escalate to code execution, data disclosure, or site takeover. No public exploit is identified at time of analysis, and the exact triggering parameter is not described in the available sources.