EUVD-2026-15793
GHSA-5f7g-3ffv-vj72
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in ThemeREX Work & Travel Company work-travel-company allows Object Injection.This issue affects Work & Travel Company: from n/a through <= 1.2.
AnalysisAI
A PHP Object Injection vulnerability exists in the ThemeREX Work & Travel Company WordPress theme through version 1.2, stemming from unsafe deserialization of untrusted data (CWE-502). An attacker can exploit this vulnerability to inject malicious objects into the application, potentially leading to remote code execution or arbitrary object manipulation depending on the gadget chains available in the WordPress environment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Remote unauthenticated attacker can exploit ThemeREX Work & Travel Company plugin version 1.2 and earlier through unsafe deserialization of untrusted data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The real-world risk of this vulnerability is HIGH despite the absence of formal CVSS and EPSS scores. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious serialized PHP object and delivers it to the vulnerable theme through an exposed endpoint that processes unserialized input, such as a theme customization API, plugin settings handler, or user-submitted form field. Upon deserialization, the malicious object triggers a chain of magic methods across WordPress core classes or popular plugin gadgets, ultimately executing arbitrary PHP code on the web server with the privileges of the web process. … |
| Remediation | Update ThemeREX Work & Travel Company to the latest available version beyond 1.2 immediately. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all affected systems and apply vendor patches immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today