Nuts WordPress Theme EUVD-2026-112970

Requires the target to be running the ThemeREX 'Nuts' WordPress theme at version 1.12 or earlier, with the vulnerable deserialization code path reachable by an unauthenticated remote request (per AV:N/PR:N/UI:N). The practical impact additionally depends on the presence of a usable PHP POP/gadget chain in the theme or co-installed plugins/core, which the available sources do not describe or confirm. Limiting factors: the affected product is a specific commercial theme rather than ubiquitous software, so exposure is bounded by how many sites run this theme; the exact input/feature that triggers unserialization is not stated in the available data.

Multiple severity signals align toward high priority but real-world risk is tempered by product footprint and thin exploitation data. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with high confidentiality, integrity and availability impact (9.8), and the vuln.today decision label is 'act_now', which argues for prompt remediation. CWE-502 (deserialization) combined with the 'PHP Object Injection' description means exploitation outcome typically hinges on available POP/gadget chains in the theme or co-installed plugins; the input does not describe the trigger or confirm a working chain, so the H/H/H impact is a plausible worst case rather than a demonstrated one. No EPSS score is supplied, so exploitation probability cannot be quantified; the vulnerability is NOT in CISA KEV; and the single reference is the Patchstack advisory, not a published proof-of-concept, so there is no confirmed public exploit. Net: a genuinely high-severity, unauthenticated flaw worth patching quickly per the act_now label, but the absence of EPSS, KEV, and any PoC - together with a niche WordPress theme footprint - suggests this is a serious-but-not-yet-widely-weaponized issue rather than a mass-exploitation emergency. Verify fixed version with ThemeREX/Patchstack, as the input lists only affected versions (<= 1.12) and no fix.

A remote attacker sends a crafted request to a WordPress site running the ThemeREX 'Nuts' theme (version 1.12 or earlier) containing a serialized PHP object in an input the theme deserializes, without needing any authentication. If a usable gadget (POP) chain exists in the theme or other installed code, deserialization can escalate to actions such as file operations, data disclosure, or remote code execution. No public exploit code is identified in the provided data, and the exact trigger is not described in the available sources.