Ozisti EUVD-2026-112952

The target must run the Ozisti WordPress theme at version 1.1.10 or earlier (cpe:2.3:a:themerex:ozisti). The CVSS vector indicates no authentication, privileges or user interaction are needed (AV:N/AC:L/PR:N/UI:N), so a reachable site is in principle exploitable in its default configuration. The decisive limiting factor for this CWE-502 class is that reaching impact requires a usable PHP POP gadget chain present in the theme, an installed plugin, or WordPress core at unserialize time; the available sources do not describe the specific injection point or confirm an exploitable gadget chain. The exact trigger (which parameter or request path reaches the vulnerable unserialize) is not described in the available sources.

Multiple signals point the same direction but rest on a single source. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a remotely reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity and availability impact, consistent with CWE-502 PHP Object Injection. The vuln.today Decision label is act_now and the record was reported by Patchstack, a recognised WordPress-vulnerability source, which raises priority. However, no EPSS probability was provided, the record is not listed in CISA KEV, and no proof-of-concept or exploit reference is present in the input - only the Patchstack advisory itself. These are distinct signals: a 9.8 base score reflects worst-case severity if a usable gadget chain exists, not a measured likelihood of exploitation, and here the exploitation-likelihood signals (EPSS, KEV, PoC) are simply absent rather than confirmed low. The practical caveat for CWE-502 is that object injection only yields code execution, file operations or similar impact when a suitable POP gadget chain is reachable in the theme, an active plugin, or WordPress core; the C:H/I:H/A:H rating assumes such a chain is available, which the available sources do not demonstrate. Net: treat as a high-priority patch item given the act_now label and unauthenticated network vector, while recognising the only severity evidence is a single-vendor advisory and real-world impact depends on gadget-chain availability.

A remote, unauthenticated attacker sends a crafted request to a WordPress site running the Ozisti theme (version 1.1.10 or earlier) containing a malicious serialized PHP object that reaches a vulnerable unserialize() call. If a suitable POP gadget chain is available in the theme, an active plugin, or WordPress core, deserialization of that object can lead to outcomes such as code execution, file manipulation or data disclosure. No public exploit code is identified in the available sources, and the specific trigger is not described; the network attack vector and low complexity (AV:N/AC:L) mean no special timing or privileges are required.