EUVD-2026-12821Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in Shinetheme Traveler allows Object Injection.This issue affects Traveler: from n/a before 3.2.8.1.
AnalysisAI
A critical PHP object injection vulnerability exists in the Shinetheme Traveler WordPress theme due to insecure deserialization of untrusted data. This affects all versions prior to 3.2.8.1 and allows unauthenticated remote attackers to execute arbitrary code, compromise data confidentiality and integrity, and cause denial of service. The vulnerability has been publicly disclosed through Patchstack's database, though no active exploitation (KEV listing) or EPSS score data is currently available.
Technical ContextAI
This vulnerability stems from CWE-502 (Deserialization of Untrusted Data), where the Traveler WordPress theme accepts serialized PHP objects from untrusted sources without proper validation. The affected product, identified by CPE cpe:2.3:a:shinetheme:traveler, processes user-controlled serialized data that can be manipulated to instantiate arbitrary PHP objects. When PHP's unserialize() function is called on attacker-controlled data, magic methods like __wakeup(), __destruct(), or __toString() can be triggered automatically, leading to remote code execution through property-oriented programming (POP) chains. This is a common vulnerability pattern in WordPress themes and plugins that improperly handle serialized data in cookies, POST parameters, or other user inputs.
RemediationAI
Immediately upgrade the Shinetheme Traveler theme to version 3.2.8.1 or later, which addresses the insecure deserialization vulnerability. Consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/traveler/vulnerability/wordpress-traveler-theme-3-2-8-php-object-injection-vulnerability?_s_id=cve for complete details on the patch. If immediate patching is not feasible, consider temporarily deactivating the Traveler theme and switching to an alternative until the update can be applied. Implement Web Application Firewall (WAF) rules to detect and block serialized PHP object patterns in user inputs as a temporary mitigation layer. Review WordPress access logs for suspicious POST requests containing serialized data (a:, O:, s: patterns) that may indicate exploitation attempts. Ensure the WordPress installation and all other plugins are updated to minimize additional attack surface.
The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via t
Unauthenticated blind SQL injection in the Shinetheme Traveler WordPress theme (all versions from initial release throug
IBM Traveler 8.x and 9.x before 9.0.1.12 allows remote authenticated users to read arbitrary files or cause a denial of
HCL Traveler contains a weak default HTTP header validation vulnerability (CWE-346) that allows authenticated attackers
The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions
HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. Rated medium severity (CVSS 5.4),
There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf). Rated medium
HCL Traveler contains a sensitive information disclosure vulnerability where error messages expose internal system detai
HCL Traveler's Apple profile generation page reflects user-submitted Logon Name and Mail Address values into generated A
HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal
HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reve
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today