EUVD-2026-96187
GHSA-x739-mm79-x5pj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify unserialize() input vector in Convex theme
-
DeliveryCraft malicious serialized PHP object
-
ExploitSubmit payload via HTTP request
-
ExecutionTrigger object injection with gadget chain
-
ImpactExecute attacker-controlled actions on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an input vector in the Convex theme (≤1.16.0) that deserializes attacker-supplied data via unserialize(), AND the presence of a reachable POP gadget chain in the theme, an active plugin, or WordPress core to convert object injection into concrete impact (RCE, file operations, or SQLi). Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required, but real-world impact is LIMITED by: (1) whether a usable gadget chain is loaded in the target environment, and (2) the specific endpoint/parameter that reaches unserialize() not being detailed in available data. WordPress must be running the Convex theme for the site to be affected. |
| Impact | The input assigns CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) via Patchstack, indicating a network-reachable, low-complexity, unauthenticated PHP Object Injection (CWE-502). However, several real-risk signals are MISSING: no EPSS score, no CISA KEV listing, and no public POC referenced in the provided data - so exploitation status is 'no public exploit identified at time of analysis'. The high CVSS should be treated with caution because PHP Object Injection impact is contingent on a usable POP (property-oriented programming) gadget chain being present in the theme or a co-loaded plugin/WordPress core; the full C:H/I:H/A:H rating assumes such a chain exists, which the description does not confirm. This is therefore a genuinely serious flaw class but currently without evidence of active or widespread exploitation, so it ranks as a patch-promptly item rather than an emergency drop-everything issue. Conflict to verify: the 9.8 all-high impact is a theoretical maximum for object injection and may overstate real impact absent a confirmed gadget chain. |
| Exploit ScenarioDerived | An unauthenticated attacker submits crafted serialized PHP data to an input vector in the Convex theme that is passed to unserialize(). If a suitable gadget chain is available in the theme, loaded plugins, or WordPress core, the injected object triggers unintended method calls (e.g., file write/delete or code execution) during object destruction or wakeup. No public exploit code is referenced, so weaponization would require an attacker to identify a working gadget chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in the ThemeREX Convex WordPress theme (versions through 1.16.0) allows remote attackers to pass crafted serialized data to an unserialize() call, potentially leading to remote code execution, file manipulation, or SQL injection if a suitable POP gadget chain is present. The vulnerability is network-reachable with no authentication or user interaction required, but successful exploitation is dependent on the target environment loading a reachable gadget chain in the theme, an active plugin, or WordPress core; independent analysis therefore rates complexity as high (AC:H) despite the original Patchstack CVSS score of 9.8 (AC:L). No public exploit code or confirmed active exploitation has been identified at time of analysis.
RemediationAI
No vendor-released patch version is specified in the available intelligence; site administrators should check the Patchstack advisory and the theme vendor for an updated release and upgrade to a version newer than 1.16.0 as soon as it becomes available. If an update is not yet offered, consider temporarily disabling the Convex theme if the site's functionality allows, though this will alter the site's appearance and may break theme-dependent features. As compensating controls, deploy a Web Application Firewall (WAF) with rules to detect and block serialized PHP payloads in request parameters, and ensure WordPress core, all plugins, and other themes are kept up to date to reduce the availability of POP gadget chains that could turn object injection into remote code execution. Note that WAF rules may cause false positives on legitimate serialized data. Additionally, restrict access to any known vulnerable endpoints if they can be identified through code review or security scanning; however, the specific vulnerable endpoint is not disclosed in the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic PHP Object Injection (CWE-502) in the Convex WordPress theme, caused by passing user-controllable input to the unserialize() function without adequate validation. When attacker-controlled serialized data is deserialized, PHP magic methods (such as __wakeup, __destruct, or __toString) in available classes can be triggered, forming a Property-Oriented Programming (POP) chain that may result in arbitrary code execution, file deletion/write, or SQL injection. The CPE cpe:2.3:a:themerex_group:convex:*:*:*:*:*:*:*:* indicates that all versions of the Convex theme up to and including 1.16.0 are affected. Exploitation requires that a usable gadget chain be reachable within the WordPress installation, which may come from the theme itself, other installed plugins, or WordPress core. The specific endpoint or parameter that reaches the vulnerable unserialize() call is not detailed in available intelligence.
Know when Wordpress Theme gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network, unauthenticated object injection, but AC:H because concrete impact depends on a usable POP gadget chain being present in the environment.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
Executive ViewAI
The ThemeREX Convex theme for WordPress, in all versions through 1.16.0, contains a critical PHP object injection flaw that is remotely reachable and requires no user interaction, with the potential for remote code execution, data manipulation, or database compromise on affected sites. Any business unit hosting WordPress properties that use this theme - including marketing, e-commerce, and public-facing brand sites - should be treated as potentially exposed, and because no vendor fix is yet available, leadership must decide on interim risk reduction while the vendor response is pending. Organizational exposure is compounded by the theme's broad install base and the difficulty of confirming exploitation after the fact.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or deactivate the ThemeREX Convex theme on any site where it is not required; for sites where it must remain active, deploy WAF virtual patching that blocks crafted serialized payloads, enable file-integrity monitoring across wp-content, restrict the WordPress database account to least privilege, audit logs for anomalous unserialize-related requests, and restrict outbound network access from web servers; consider temporarily placing affected sites behind authentication or IP allow-listing if business use permits.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
More in Wordpress Theme
View allThe Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the news
The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and in
A vulnerability in posimyththemes Nexter nexter.0.3. Rated high severity (CVSS 8.5), this vulnerability is remotely expl
The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Acti
Remote code execution in the dmcwebzone Airin Blog WordPress plugin (versions up to and including 1.6.1) is possible thr
Unauthenticated arbitrary file upload in the Clanora WordPress theme (versions before 1.3.1) allows remote attackers to
search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS. Rated medium severity (CVSS 6.1), thi
Arbitrary file upload in the CMSSuperHeroes Wastia WordPress theme (all versions before 1.1.3) allows remote attackers t
Unauthenticated arbitrary file upload in the Doctreat WordPress theme (versions up to and including 1.7.0) allows remote
Unrestricted Upload of File with Dangerous Type vulnerability in EPC AI Hub allows Upload a Web Shell to a Web Server.3.
Backdoor / malicious code implant in the Silk Themes 'Newspapers X' WordPress theme (versions 1.0.46 through 1.0.48) all
Critical unrestricted file upload vulnerability in NasaTheme Flozen that allows unauthenticated remote attackers to uplo
Exploit-DB