Motorix EUVD-2026-112968

Exploitation requires that the target WordPress site has the Motorix theme (ThemeRex) installed and active at version 1.11 or earlier, and that attacker-supplied input reaches a PHP unserialize() call; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed against such an installation. The practical limiting factor for PHP Object Injection is the availability of a usable POP gadget chain in the theme, loaded plugins, or WordPress core - without a reachable gadget, object injection may not translate into full code execution; the available sources do not confirm which gadget chain or input parameter is involved. The real-world footprint is further limited because Motorix is a niche commercial theme rather than widely deployed software.

All signals point in the same direction: the input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity and availability impact, and the vuln.today decision label is 'act_now' - so this should be treated as a near-term patching priority, not a high-CVSS-but-low-real-risk issue. The weighting flaw class (CWE-502, PHP Object Injection via deserialization) is a well-understood RCE/data-tampering primitive in the WordPress ecosystem, and the finding was reported by Patchstack, a credible WordPress-focused source. That said, several signals are MISSING from the input and should temper absolute certainty: there is no EPSS probability, no CISA KEV listing, and no POC/Exploit indicator, so there is no evidence of active or probability-weighted exploitation at this time - the urgency here derives from the act_now decision label and the unauthenticated 9.8 vector, not from observed exploitation. One inherent caveat for this bug class: PHP Object Injection only yields concrete impact when a usable POP gadget chain is present in the theme or loaded plugins/core; the available sources do not state whether such a chain is confirmed, so the realized C/I/A impact may depend on the surrounding deployment.

A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running the Motorix theme (version 1.11 or earlier) containing an attacker-controlled serialized PHP object to an input that is passed to unserialize(). If a suitable POP gadget chain is reachable, this leads to object injection that can be leveraged for code execution, file operations, or data tampering. No public exploit is identified in the provided data, and the exact trigger (which parameter or feature deserializes input) is not described in the available sources.