Orpheus Theme EUVD-2026-112971

The affected component is the ThemeRex Orpheus WordPress theme at version 1.8 or earlier, which must be installed and active on the target site. Per the CVSS vector (PR:N/UI:N) exploitation is unauthenticated and requires no user interaction, so no special configuration or privilege is stated as a precondition. The exact injection point (parameter, endpoint, or feature) that reaches the unsafe deserialization is not described in the available sources, and the trigger mechanism is not detailed. The primary limiting factor is that practical object-injection impact depends on a usable PHP gadget (POP) chain being present in the theme, WordPress core, or co-installed plugins - a condition the sources do not confirm - and that only sites running Orpheus ≤1.8 are exposed.

Signals point in two directions and must be weighed together. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) describes a maximally severe case: network-reachable, low-complexity, no privileges and no user interaction, with full confidentiality, integrity and availability loss - consistent with CWE-502 PHP Object Injection that can escalate to code execution. The vuln.today decision label is act_now, and the issue was reported by Patchstack, a credible WordPress vulnerability source. Against that, there is NO EPSS score, NO CISA KEV listing, and NO public exploit or PoC reference in the supplied data (the only reference is the Patchstack database entry, not exploit code), so there is no public exploit identified at time of analysis. The act_now priority therefore appears driven by severity and the unauthenticated nature of the flaw rather than by observed exploitation - treat it as high-priority to patch, but note that real-world exploitability of PHP Object Injection depends on a usable gadget (POP) chain being reachable, which the available sources do not confirm. Net: a genuine high-priority patching item on the merits of an unauthenticated, network-facing deserialization flaw, but with no evidence of active or automated exploitation to date; prioritize based on severity and exposure, not on confirmed in-the-wild activity.

A remote attacker sends a crafted request to a WordPress site running the Orpheus theme (version 1.8 or earlier) containing a malicious serialized PHP object, which the theme deserializes without authentication (AV:N/AC:L/PR:N/UI:N). If a suitable gadget chain is present in the theme, WordPress core, or another installed plugin, the object injection can be escalated toward data manipulation or code execution. No public exploit or PoC code is identified in the available data.