EUVD-2026-96188
GHSA-jr82-xf5g-vmwf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted request to Dwell endpoint
-
DeliveryDeliver malicious serialized PHP object
-
ExploitTrigger unserialize() object injection
-
ExecutionPOP gadget chain executes payload
-
ImpactAchieve RCE or data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The site must run the ThemeREX Group Dwell theme at version 1.16.0 or earlier, and an attacker must reach the code path that deserializes untrusted input via PHP unserialize(). The primary limiting factor is CWE-502 specific: object injection only escalates to meaningful impact (RCE, file write, SQL injection) when a usable POP gadget chain is reachable in the theme, WordPress core, or another installed plugin; without such a chain, impact may be constrained to object instantiation side effects. Per the supplied CVSS vector (PR:N/UI:N) no authentication or user interaction is required to reach the sink, but the real-world severity hinges on gadget-chain availability in the specific deployment. |
| Impact | All quantitative signals point one direction while a qualitative caveat tempers them. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 CRITICAL) describes a remote, unauthenticated, low-complexity flaw with total impact, which on its face is a top-tier priority. However, no EPSS probability, no SSVC decision data, no POC indicator, and no CISA KEV listing were supplied, so there is no independent evidence of active or imminent exploitation - exploitation status is therefore 'no public exploit identified at time of analysis'. A key qualitative conflict exists: CWE-502 PHP object injection vulnerabilities are only weaponizable to code execution when a usable POP gadget chain is reachable in the theme, WordPress core, or co-installed plugins; when no gadget chain is present, real-world impact is often limited despite the AC:L rating. The AC:L in the input likely does not account for this gadget-chain dependency, so I assess attack complexity as higher than stated. Net: a genuinely serious flaw worth prompt patching for any site running Dwell, but the absence of EPSS/KEV/POC signals and the gadget-chain dependency mean it is not demonstrably under mass exploitation - treat as high-priority-to-patch rather than emergency-in-the-wild. |
| Exploit ScenarioDerived | A remote attacker sends a crafted request to a Dwell theme endpoint that passes attacker-controlled input to a PHP unserialize() call, injecting a malicious serialized object. If a suitable POP gadget chain is present in the theme, WordPress core, or another installed plugin, the injected object triggers that chain on instantiation to achieve file write, SQL manipulation, or remote code execution. No public exploit code was identified in the provided data, and successful code execution depends on the availability of a reachable gadget chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
PHP object injection in the ThemeREX Group Dwell WordPress theme (versions up to and including 1.16.0) allows unauthenticated remote attackers to send crafted serialized data to an unserialize() sink, which can lead to file deletion, SQL injection, or remote code execution if a usable POP gadget chain exists in the site's installed theme, plugins, or WordPress core. The published CVSS score is 9.8, but independent assessment rates attack complexity as high because real-world impact depends entirely on gadget-chain availability in the specific deployment; no public exploit code or confirmed active exploitation was identified at time of analysis. This is a WordPress theme vulnerability reported by Patchstack and tracked as EUVD-2026-96188.
RemediationAI
No vendor-released patch is identified in the available data at time of analysis; consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/dwell/vulnerability/wordpress-dwell-theme-1-16-0-php-object-injection-vulnerability?_s_id=cve) for an updated fixed version. If the theme is not actively used, remove or disable it entirely to eliminate exposure. For sites that must keep the theme, implement virtual patching through a WordPress WAF or security plugin that blocks serialized payloads targeting the vulnerable unserialize() sink; note that overly broad WAF rules may cause false positives on legitimate serialized data. Since exploitation depends on a POP gadget chain, reducing the number of installed plugins and keeping all components updated limits the availability of usable chains. Restrict access to theme-related AJAX or REST endpoints if possible, and monitor logs for unusual serialized input. Removing or disabling the theme will break the site's visual design and functionality, so plan a migration or replacement theme if a patch is not released promptly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-502 (Deserialization of Untrusted Data) in PHP occurs when attacker-controlled input is passed to unserialize() without adequate validation. In WordPress themes, such sinks often appear in AJAX actions, REST endpoints, or theme option handlers. If a gadget chain is present-a sequence of magic methods (__wakeup, __destruct, __toString, etc.) in the theme, another plugin, or WordPress core-object injection can escalate to arbitrary file deletion, SQL injection, or remote code execution. The CPE cpe:2.3:a:themerex_group:dwell:*:*:*:*:*:*:*:* confirms all versions of the Dwell theme are affected, with the EUVD record specifying version 0 through 1.16.0. The published CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) suggests low complexity, but the independent assessment adjusts AC to High because exploitation is only as severe as the available gadget chain permits. No authentication (PR:N) or user interaction (UI:N) is required to reach the sink per the vector.
Know when Dwell gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote and unauthenticated (AV:N/PR:N/UI:N), but AC:H because CWE-502 object injection requires a reachable POP gadget chain for full C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.
Executive ViewAI
The ThemeREX Dwell WordPress theme (versions up to and including 1.16.0) contains a critical PHP object injection flaw in which crafted serialized data reaching an unserialize() sink can result in remote code execution, data manipulation, or destructive file operations on affected sites. Because no vendor patch is currently available and the theme is widely deployed across public-facing WordPress estates, any organization hosting marketing, regional, or subsidiary sites on Dwell should treat this as a priority remediation item. Leadership should care because successful exploitation could hand an attacker full control of the underlying web server, with downstream exposure of customer data, brand integrity, and regulatory obligations.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or deactivate the Dwell theme (versions up to and including 1.16.0) wherever it is not business-critical; apply WAF virtual patching to block serialized object payloads targeting theme parameters; disable PHP execution in upload directories and enforce strict file permissions; restrict administrative access to the WordPress instance; and monitor for unexpected file deletions, SQL errors, and anomalous outbound connections pending vendor remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB