EUVD-2026-96192
GHSA-7ghx-gjh7-w66h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to Hygia endpoint
-
DeliveryDeliver malicious serialized PHP object
-
ExploitTrigger unsafe deserialization (CWE-502)
-
ExecutionPOP gadget chain executes object
-
ImpactCompromise site data and code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ThemeREX Hygia theme (version 1.21.0 or earlier) to be installed and active on a reachable WordPress site, and a user-controllable input that reaches an unsafe PHP unserialize() call. The practical precondition that LIMITS impact is the availability of a usable POP (property-oriented programming) gadget chain in the theme, WordPress core, or another installed plugin - without such a chain, object injection may not translate into code execution or file/database compromise. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is needed, so the limiting factor is primarily gadget-chain presence and the affected theme being installed, rather than configuration or privilege. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes a remotely reachable, unauthenticated, low-complexity flaw with full confidentiality, integrity, and availability impact - a worst-case profile consistent with PHP Object Injection via untrusted deserialization (CWE-502). However, critical corroborating signals are ABSENT: no EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC was supplied, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data (exploitation/automatable/technical impact) was provided. An important nuance tempers the 9.8: PHP Object Injection only yields real-world RCE or file/database impact when an exploitable POP (property-oriented programming) gadget chain is present in the theme, WordPress core, or an installed plugin - the raw CVSS assumes full impact is achievable, which is not independently verified here. Net assessment: treat as a high-priority patch item for sites running the Hygia theme because the attack surface is unauthenticated and network-facing, but the lack of KEV/EPSS/POC signals suggests this is not (yet) evidence of widespread active exploitation. Prioritize based on exposure (is the affected theme installed and reachable) rather than assuming imminent mass exploitation. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a WordPress site running the Hygia theme (≤1.21.0), supplying a malicious serialized PHP object to a parameter that is deserialized without validation. If a suitable POP gadget chain exists in the theme, core, or an installed plugin, the injected object triggers it to achieve arbitrary file operations, database manipulation, or code execution. No public exploit code was identified at time of analysis, and the CVSS vector indicates no authentication or user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
PHP object injection in the ThemeREX Hygia WordPress theme (versions through 1.21.0) lets unauthenticated remote attackers pass crafted serialized data into an unsafe PHP deserialization call, which can lead to full compromise of confidentiality, integrity, and availability on any site running the affected theme. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) confirms the attack is network-reachable with no authentication and no user interaction, making every site with an active vulnerable Hygia install a candidate target. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though the practical ceiling of the attack depends on whether a usable POP gadget chain exists in the theme, WordPress core, or another installed plugin.
RemediationAI
No vendor-released patch was identified at time of analysis, so administrators should treat removal or deactivation as the first-line action: if Hygia is not essential, deactivate and delete the theme folder, and if it must stay installed, confirm with the vendor (ThemeREX Group) whether a fixed release newer than 1.21.0 has appeared and upgrade to that exact version once published - do not assume a version number. Because an unsafe deserialization sink is only dangerous through a gadget chain, an effective interim control is to reduce available gadgets: remove unused or abandoned plugins and keep WordPress core and all remaining plugins at current releases, since a smaller set of loaded classes makes a working POP chain far harder to assemble; the trade-off is that gadget-chain availability cannot be verified from outside, so this is risk reduction, not a fix. Additionally, front the site with a WAF or reverse proxy that inspects request bodies and parameters for PHP serialization payloads (O: and a: markers) and blocks them, accepting that legitimate serialized data used by some plugins can cause false positives. Restrict or disable direct access to theme PHP files that handle user input via webserver rules where feasible, and monitor logs and file integrity for post-exploitation signs such as unexpected PHP files, modified templates, or new admin accounts. Consult the Patchstack advisory link above for vendor status updates before relying on any single mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-502 (Deserialization of Untrusted Data), the classic PHP Object Injection pattern: attacker-controlled input reaches an unsafe unserialize() call inside the Hygia theme, and PHP reconstructs arbitrary objects of classes already loaded by the application. Reconstruction alone is not code execution - the impact materializes when a magic method (__wakeup, __destruct, __toString, etc.) is triggered on a reconstructed object and that method is part of a property-oriented programming (POP) gadget chain capable of, for example, writing files, issuing SQL, or executing further code. This is why the assessed impact of 9.8 is a worst-case profile rather than a guaranteed outcome: the presence of a suitable gadget chain in the theme, WordPress core, or a co-installed plugin is the real pivot to file or database compromise. The affected component is the ThemeREX Group Hygia WordPress theme, tracked as CPE cpe:2.3:a:themerex_group:hygia:*:*:*:*:*:*:*:* with versions from n/a through 1.21.0 vulnerable, and the report originates from Patchstack's vulnerability database for the WordPress theme.
Know when Hygia gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization gives AV:N/PR:N/UI:N; AC:L and full C/I/A impact assume a reachable POP gadget chain, consistent with the source rating.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.
Executive ViewAI
The ThemeREX Hygia theme for WordPress - installed on an unknown but potentially large number of public-facing websites - contains a critical unauthenticated PHP object injection flaw affecting all versions through 1.21.0, and no vendor patch is currently available. Because the attack requires no credentials and no user action, any site running the affected theme is a potential target for full takeover of data, content, and availability. Leadership should treat this as a live exposure-management problem for every business unit, brand, or subsidiary that publishes on WordPress with this theme.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate and remove the ThemeREX Hygia theme (versions through 1.21.0) and replace it with a maintained theme; where removal is not immediately possible, deploy WAF/virtual-patching rules blocking serialized-object and deserialization attack patterns, disable unused theme endpoints and REST/AJAX routes, restrict administrative access, and monitor for indicators of compromise. Note: no public exploit identified at time of analysis, and exploitation success depends on the availability of a usable POP gadget chain in the theme, WordPress core, or installed plugins.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB