EUVD-2026-96186
GHSA-6c7p-2q6j-98g8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site using Camelia theme
-
DeliverySend crafted serialized object payload
-
ExploitTrigger unserialize() object injection
-
ExecutionInvoke PHP magic-method gadget chain
-
ImpactAchieve code execution or data tampering
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must run the ThemeREX Group Camelia WordPress theme at version 1.2.15 or earlier, with a code path that deserializes attacker-controlled input via unserialize(). Per the supplied CVSS vector (PR:N/UI:N), exploitation requires no authentication and no user interaction. A practical LIMITING factor not captured by the score: PHP Object Injection only yields meaningful impact (RCE, file operations, SQLi) when a usable POP gadget chain is present in the theme, WordPress core, or active plugins; without such a chain, impact may be limited or unachievable. No fixed version is confirmed in the input, so remediation requires verifying an updated release directly with ThemeREX/Patchstack. |
| Impact | The input assigns a critical CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), modeling unauthenticated, network-reachable exploitation with full compromise of confidentiality, integrity, and availability - consistent with CWE-502 PHP Object Injection that reaches remote code execution. However, several key real-world signals are MISSING: no EPSS probability was provided, the vulnerability is NOT listed in CISA KEV, and no public proof-of-concept is referenced (only a Patchstack database entry). This means there is no public exploit identified at time of analysis and no evidence of active exploitation, so the 9.8 should be read as theoretical worst-case rather than confirmed field risk. A critical caveat specific to PHP Object Injection: practical exploitability depends on a usable POP (property-oriented programming) gadget chain being reachable within the theme or its loaded WordPress/plugin dependencies; if no gadget chain is present, impact may degrade to a crash or be non-exploitable, which the AC:L rating does not reflect. On balance this is a genuine high-priority patch item for sites running the affected Camelia theme, but the absence of EPSS/KEV/POC data and the gadget-chain dependency argue against treating it as an imminent, widely-weaponized threat. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker submits a crafted serialized PHP payload to an endpoint in the Camelia theme (≤1.2.15) that passes untrusted input to unserialize(). If a suitable gadget chain exists in the loaded code, the injected object triggers magic methods (e.g. __wakeup/__destruct) leading to arbitrary code execution or data manipulation on the WordPress server. No public exploit code is identified at time of analysis, and the CVSS AV:N/AC:L/PR:N/UI:N vector indicates no authentication or user interaction would be required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP Object Injection in the ThemeREX Group Camelia WordPress theme (versions through 1.2.15) lets a remote attacker supply crafted serialized input that the theme passes to PHP's unserialize(), enabling injection of arbitrary PHP objects into the application's execution flow. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), no authentication and no user interaction are required, and the potential impact spans full loss of confidentiality, integrity, and availability - typically realized as remote code execution, arbitrary file manipulation, or SQL injection when a usable POP gadget chain is reachable. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); practical exploitability is gated by the availability of a viable gadget chain across the theme, WordPress core, or co-installed plugins.
RemediationAI
No vendor-released patch or fixed version is identified for CVE-2026-93944 in the available input, so the primary action is to verify the latest Camelia release directly with ThemeREX Group and via the Patchstack advisory at https://patchstack.com/database/wordpress/theme/camelia/vulnerability/wordpress-camelia-theme-1-2-15-php-object-injection-vulnerability?_s_id=cve, and upgrade the moment a patched build is published. Until then, the highest-confidence mitigation is to deactivate and remove the Camelia theme entirely from any internet-facing site - the trade-off is loss of the site's current presentation layer, which must be replaced with a maintained theme, but it eliminates the vulnerable code path rather than merely filtering input. If removal is not feasible, deploy a virtual patch or WAF rule that rejects requests carrying serialized-object patterns (strings matching O:<length>:"<classname>") in POST bodies, cookies, and query parameters before they reach PHP; this is effective only against straightforward payloads and can be bypassed by encoding or object-reference tricks, and it may break legitimate theme functionality that relies on serialized data such as options or widget state. Additionally, harden the environment against gadget-chain exploitation by keeping WordPress core and every installed plugin fully patched, since an outdated plugin supplies the magic-method classes an attacker needs to convert object injection into RCE, and restrict theme/plugin file editing by setting DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS in wp-config.php. Where feasible, constrain the blast radius with a web application firewall in blocking mode and least-privilege filesystem permissions on wp-content, accepting the operational overhead of tighter file controls and the risk of false positives from aggressive WAF rules.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-502, Deserialization of Untrusted Data, in a WordPress theme distributed by ThemeREX Group. PHP's unserialize() reconstructs objects from a string and invokes magic methods such as __wakeup() and __destruct() during reconstruction; when the serialized payload is attacker-controlled, the attacker can select which classes are instantiated and in what property state, effectively steering control flow through whatever magic-method callbacks exist in the loaded codebase. On its own, object injection is a primitive rather than a finished exploit: meaningful outcomes (arbitrary file write/delete, SQL injection, or remote code execution) require a POP (property-oriented programming) gadget chain assembled from the theme, WordPress core, or active plugins, and the assessed impact assumes such a chain is present in the target environment. The affected component is identified by CPE cpe:2.3:a:themerex_group:camelia:*:*:*:*:*:*:*:*, which matches all versions of the Camelia theme as shipped by the vendor; the vulnerable range ends at 1.2.15. Because the vector carries PR:N and UI:N, the vulnerable deserialization path is modeled as reachable over the network without credentials or victim interaction, which is characteristic of an unserialize() call on a request-supplied parameter (for example an AJAX action, cookie, or POST field) rather than an administrative-only code path.
Know when Camelia gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network deserialization (AV:N/PR:N/UI:N) with potential full RCE justifies C/I/A:H; AC:L retained per source, though a required gadget chain could arguably raise it to AC:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.
Executive ViewAI
The Camelia theme from ThemeREX, deployed across our WordPress footprint in versions up to 1.2.15, carries a critical unauthenticated flaw that could hand an outside attacker full control of any affected site's data, content, and underlying server. Because no login or user action is needed, every internet-facing site running this theme is a potential entry point, and a single compromise could expose customer data, corrupt published content, and take sites offline. Leadership should treat this as an immediate website-integrity and brand-risk event until the theme is removed or otherwise neutralized.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or deactivate the Camelia theme where possible; deploy WAF/virtual-patching signatures that reject crafted serialized input targeting the theme; restrict access to theme endpoints and WordPress admin/REST interfaces; reduce the available POP gadget surface by removing unused plugins and themes; monitor web and application logs for anomalies indicating object injection or post-exploitation activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB