Mission Theme EUVD-2026-112967

Requires that the target site run the ThemeREX Mission WordPress theme at version 1.22 or earlier and expose the vulnerable endpoint that deserializes attacker-supplied input; per CVSS PR:N and UI:N and the 'Unauthenticated' label, no login or user interaction is needed. Practical exploitability to full RCE further depends on a usable PHP gadget chain being present in the theme, WordPress core, or active plugins - the available sources do not identify the specific injectable parameter or the gadget chain, so the realized impact may vary by site. The main limiting factor is deployment: only sites running this particular theme are affected, which constrains the attackable population.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a remotely reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity and availability impact - the maximal severity profile. The vuln.today decision label is act_now, and Patchstack (the reporter) classifies this as an unauthenticated PHP Object Injection (CWE-502), which is a credible RCE-class vulnerability class for WordPress themes. However, several real-world risk signals are MISSING from the input: there is no EPSS exploitation-probability score, no CISA KEV listing, and no POC/exploit reference beyond the Patchstack database advisory itself. Because KEV is absent, this is NOT confirmed as actively exploited; because no exploit code is referenced, there is no public exploit identified at time of analysis. The high CVSS and act_now label therefore reflect the intrinsic severity of unauthenticated deserialization rather than observed in-the-wild activity. A key caveat: PHP Object Injection impact depends on the presence of a usable gadget chain in the theme or its loaded dependencies - the description does not state what the deserialization actually reaches, so the C:H/I:H/A:H assumption of full RCE is plausible but unverified. Net: treat as a genuine high priority for anyone running the Mission theme (act_now), while noting that the breadth of exploitation cannot be judged without EPSS/KEV data and the product's limited deployment footprint likely makes this targeted rather than mass-exploited.

A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running the ThemeREX Mission theme (<= 1.22), supplying attacker-controlled serialized PHP data to an endpoint that deserializes untrusted input. If a suitable gadget chain is reachable, the unserialize() call instantiates attacker-chosen objects leading to code execution or other high-impact effects. No public exploit code is identified at time of analysis; the precise injectable parameter and gadget chain are not described in the available sources.