Meals & Wheels EUVD-2026-112966

The ThemeRex 'Meals & Wheels' theme at version 1.1.13 or earlier must be installed and active on the target WordPress site; the CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is required, so exploitation is remote and unauthenticated against affected installations. The exact entry point and trigger are not described in the available sources. Practical impact for a CWE-502 object-injection flaw generally depends on a reachable POP gadget chain in the theme or loaded plugins/core; the sources do not confirm such a chain, which is the primary factor limiting realistic exploitation. No fixed version is listed in the provided evidence.

Multiple severity signals align toward high priority but with a key caveat. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality, integrity and availability impact (base 9.8), and the vuln.today Decision label is act_now, so the recommended posture is to remediate immediately rather than defer. CWE-502 (deserialization of untrusted data) in PHP typically enables code-level compromise, consistent with the C:H/I:H/A:H rating. However, several decision inputs are absent: no EPSS exploitation-probability score is provided, the CVE is not listed in CISA KEV, and there is no confirmed public exploit - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The real-world impact of PHP object injection usually depends on a usable POP gadget chain being reachable in the theme or its loaded dependencies, and the available sources do not describe the trigger or confirm an exploitable gadget chain; this is the main factor that can separate a 9.8-on-paper rating from practical remote code execution. Net: treat as a genuine act_now priority given the unauthenticated network vector and Patchstack sourcing, while noting exploitation feasibility in a given installation is not independently confirmed by the provided data.

A remote, unauthenticated attacker sends crafted input to a WordPress site running the Meals & Wheels theme (<= 1.1.13) that is deserialized by vulnerable PHP code, injecting a malicious serialized object. If a suitable gadget chain is present, the injected object can be leveraged for actions up to arbitrary code execution or data compromise. No public exploit was identified at time of analysis, and the specific trigger is not described in the available sources.