EUVD-2026-112969
GHSA-2hf9-2hp5-cqmq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach unauthenticated Muzicon endpoint
-
DeliverySubmit crafted serialized PHP payload
-
ExploitTrigger object injection via unserialize
-
ExecutionGadget chain executes code
-
ImpactCompromise WordPress site
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Affects ThemeRex Muzicon theme versions 1.15 and earlier; exploitation requires reaching the theme code path that deserializes untrusted input (CWE-502), and no authentication is required per PR:N. The precise endpoint and input parameter are not described in the available sources. Practical code execution additionally requires a reachable PHP gadget (POP) chain in the theme, WordPress core, or co-installed plugins - the sources do not confirm which chain, if any, is present by default; this is the main limiting factor. No special configuration, user interaction, or non-default mode is indicated as required. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, unauthenticated, low-complexity flaw with high impact to confidentiality, integrity and availability - consistent with CWE-502 PHP Object Injection, which commonly escalates to remote code execution when a usable gadget (POP) chain is present. The vuln.today decision label is act_now, which raises urgency. However, the corroborating exploitation signals are thin: no EPSS score is provided, there is no CISA KEV listing, and no verified public exploit code is supplied - the single reference is the Patchstack advisory, not a working PoC. So the act_now label and the 9.8 severity rest primarily on the vector's unauthenticated/high-impact profile and vendor (Patchstack) analysis rather than on observed exploitation or a published exploit. This is a genuine high priority for anyone running the affected theme (unauthenticated + potential RCE), but the real-world probability signal (EPSS) is missing rather than high, so the urgency is driven by potential impact and ease, not by evidence of active or widespread exploitation. Actual code execution further depends on whether a gadget chain is reachable in the installed WordPress/plugin stack, which the available sources do not describe. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to a Muzicon (<= 1.15) endpoint that deserializes attacker-controlled input, injecting a malicious PHP object. If a suitable gadget chain exists in the theme, WordPress core, or co-installed plugins, the injected object triggers that chain on unserialization, potentially leading to remote code execution or site compromise. No public working exploit code is identified in the provided data; only the Patchstack advisory reference is available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
Unauthenticated PHP object injection in the ThemeRex Muzicon WordPress theme through version 1.15 allows remote attackers to pass attacker-controlled serialized data into an unserialize() sink without any credentials, which can corrupt application state or escalate to code execution if a usable gadget chain is reachable. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is tracked under CWE-502; no public exploit code has been reported, it is not listed in CISA KEV, and no EPSS figure was supplied. The practical limiting factor is the need for a POP chain in the theme, WordPress core, or a co-installed plugin, and the precise vulnerable endpoint and parameter are not described in the available sources.
RemediationAI
No vendor-released patch was identified in the available data at time of analysis; the only reference supplied is the Patchstack advisory at https://patchstack.com/database/wordpress/theme/muzicon/vulnerability/wordpress-muzicon-theme-1-15-php-object-injection-vulnerability?_s_id=cve, which should be monitored for a fixed theme version. Because the flaw is unauthenticated and there is no confirmed fix, the most effective compensating control is to deactivate and remove the Muzicon theme from production sites entirely until an updated release appears, accepting the loss of the theme's design and layout features and any customizations built on it. If the theme must stay active, use a WAF to inspect request parameters, cookies, and POST bodies for PHP serialized object patterns (strings containing O: followed by a class name and length specifiers) and block them before they reach the theme code path, recognizing that obfuscated payloads and false positives are both possible and that a generic rule set will not stop every variant. Reducing the gadget surface also matters: remove unused plugins and keep WordPress core and all remaining plugins current so known POP chains are not available on the site, though this reduces rather than eliminates the escalation path. Blocking direct access to theme PHP files that are not meant to be reached directly, and virtual-patching the theme's request entry points, adds defense but requires identifying the affected endpoint, which the available sources do not specify. Given the act_now priority and 9.8 severity, plan for removal or replacement of the theme rather than long-term reliance on filtering.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a PHP object injection (CWE-502) in the ThemeRex Muzicon WordPress theme, identified by CPE cpe:2.3:a:themerex:muzicon affecting all versions up to and including 1.15. In this bug class, data supplied by the request is passed to PHP's unserialize() (or an equivalent deserialization path) without restricting which classes may be instantiated. Because PHP instantiates classes named in the serialized payload and then invokes magic methods such as __wakeup, __destruct, and __toString during object lifecycle, an attacker can steer execution through whatever gadget (POP) chain exists in the loaded codebase. The impact therefore depends heavily on the plugin and theme stack installed alongside Muzicon: the sources do not confirm which chain, if any, is present by default, and do not identify the specific endpoint or request parameter that reaches the deserialization sink. Authentication is not required according to the PR:N vector, and no non-default configuration, privilege, or user interaction is indicated as a prerequisite. The high confidentiality, integrity, and availability ratings reflect the potential for arbitrary code execution and full site compromise once a chain is available; that ceiling should be read as conditional on gadget availability rather than as a guaranteed outcome on every installation.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated (PR:N) network deserialization with no user interaction (AV:N/AC:L/UI:N); PHP object injection can yield full code execution, so C/I/A all High.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.
Executive ViewAI
The ThemeRex Muzicon WordPress theme (versions through 1.15) contains a critical unauthenticated PHP object injection vulnerability that could allow attackers to corrupt application state or potentially execute code. Since this affects a public-facing theme with no credentials required, any organization using this theme is exposed to remote attacks, and while no public exploit code exists yet, the severity demands immediate leadership attention.
No vendor-released patch identified at time of analysis; interim mitigations include implementing WAF rules to block serialized object injection attempts, restricting network access to the vulnerable endpoint if known, and considering theme replacement until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB