EUVD-2026-96184
GHSA-grw9-6gf5-p4rx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Gutentype theme endpoint
-
DeliverySend crafted serialized PHP object
-
ExploitTrigger unserialize() object injection
-
ExecutionPOP gadget chain executes
-
ImpactAchieve code execution or data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that attacker-controlled input reaches a PHP unserialize() call within the Gutentype theme on a vulnerable version (n/a through 2.1.12). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication or user interaction is required and the attack is network-remote against the affected theme. The key limiting factor, inherent to PHP Object Injection, is the need for a usable POP gadget chain present in the theme, WordPress core, or an installed plugin to convert the injection into meaningful impact; without such a chain the practical impact may be substantially lower than the 9.8 base score suggests. Exploitation is further bounded to sites running the Gutentype theme active and unpatched. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8 Critical) describes a fully remote, unauthenticated PHP Object Injection flaw (CWE-502) with total confidentiality, integrity, and availability impact - a signature high-severity WordPress profile. However, the real-world risk picture is incomplete: no EPSS score is provided, the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' A critical caveat specific to PHP Object Injection: the base CVSS assumes a usable POP (property-oriented programming) gadget chain is reachable, but deserialization bugs are frequently only practically exploitable when a vulnerable gadget chain exists in the theme or an installed plugin/WordPress core; the Patchstack advisory does not confirm a weaponizable chain here. Net assessment: this is a genuinely serious flaw that should be patched promptly, but the absence of KEV, EPSS, and POC signals means it is a high-CVSS issue without current evidence of active or widespread exploitation - treat as high-priority remediation rather than emergency incident response. Conflicting-signal note: the 9.8 score assumes attacker-controlled serialized input reaches unserialize() against a default install, which should be verified against the Patchstack technical detail. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request containing a malicious serialized PHP object to a Gutentype theme endpoint that passes attacker input to unserialize(). If a suitable POP gadget chain is present in the theme, WordPress core, or an active plugin, the object injection is triggered during deserialization, potentially leading to arbitrary file operations, SQL injection, or remote code execution. No public exploit code is referenced, and successful exploitation depends on the availability of a reachable gadget chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
PHP object injection in the ThemeREX Gutentype WordPress theme (all versions through 2.1.12) allows remote, unauthenticated attackers to inject arbitrary PHP objects through unsafe deserialization of untrusted data, with the potential for full confidentiality, integrity, and availability impact if a usable gadget chain is reachable. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates attack complexity as High because practical exploitation depends on the presence of a suitable POP gadget chain in the theme, WordPress core, or an installed plugin - without one, real-world impact is likely lower than the base score implies. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing); exploitation is bounded to sites running the Gutentype theme, unpatched, at version 2.1.12 or earlier.
RemediationAI
No vendor-released patch or fixed version is identified in the supplied intelligence, so remediation begins with checking the Patchstack advisory page (https://patchstack.com/database/wordpress/theme/gutentype/vulnerability/wordpress-gutentype-theme-2-1-12-php-object-injection-vulnerability?_s_id=cve) for an updated theme release and applying it as soon as ThemeREX publishes one; until then, the most reliable action is to deactivate and remove the Gutentype theme from production sites, accepting the loss of its design and layout functionality. Where the theme must remain active, reduce the attack surface by removing unused plugins and themes - this shrinks the pool of classes available for a gadget chain and can break otherwise working exploits - at the cost of testing effort and possible site breakage. Additionally, deploy a WAF or virtual patching rule that blocks serialized PHP object payloads (strings matching the O:\d+:"..." object pattern) in query parameters and POST bodies reaching the theme, noting that legitimate serialized data used by some plugins may be affected. Restrict and monitor access to WordPress administrative endpoints and review server logs for anomalous serialized input, and harden the site by keeping WordPress core and all plugins current so that known gadget-chain primitives are eliminated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a CWE-502 Deserialization of Untrusted Data flaw in the ThemeREX Group Gutentype WordPress theme, tracked under CPE cpe:2.3:a:themerex_group:gutentype. In PHP, passing attacker-controlled input to unserialize() (or to a framework function that internally unserializes, such as WordPress option/transient or metadata handling paths) lets an attacker define the class and property values of the objects that get instantiated. The dangerous part is not the object itself but the magic methods (__wakeup, __destruct, __toString, etc.) that execute during or after deserialization; chaining these through existing classes forms a POP (Property-Oriented Programming) gadget chain that can turn the injection into file operations, SQL execution, or arbitrary code execution. Because the vulnerability sits in a WordPress theme supplied by a commercial marketplace vendor, the attack surface is the theme's own request-handling code, and the eventual impact is mediated by whatever classes WordPress core and any active plugins make available on the target site.
Know when Gutentype gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated (AV:N/PR:N/UI:N), but AC:H because reliable object-injection impact depends on a reachable POP gadget chain; full C/I/A impact when a chain exists.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.
Articles & Coverage 1
Executive ViewAI
Every website running the ThemeREX Gutentype WordPress theme at version 2.1.12 or earlier is exposed to an unauthenticated PHP object injection flaw that could allow an outside attacker to take full control of site content, data, and availability. Because the theme is typically deployed on public-facing marketing and content sites, a successful compromise could result in defaced pages, injected malicious content served to customers, and theft of any data the site collects. Leadership should care because no vendor patch currently exists, leaving remediation dependent on removing or isolating the theme rather than a routine update.
No vendor-released patch identified at time of analysis. Interim mitigations: remove, deactivate, or replace the Gutentype theme (all versions through 2.1.12); take exposed sites offline or place them behind authentication; deploy WAF/virtual-patching rules targeting serialized-object payloads; monitor for indicators of compromise and review logs; restrict PHP execution and file-write permissions to limit gadget-chain reachability; rotate credentials and secrets on any potentially exposed site.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB