EUVD-2026-96193
GHSA-5p9m-cj8c-rf88
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach theme input over HTTP
-
DeliverySubmit crafted serialized PHP payload
-
ExploitTrigger unserialize() object injection
-
ExecutionChain POP gadget to code/file operation
-
ImpactCompromise WordPress site
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an input vector in the IPharm theme (≤ 1.2.4) that passes attacker-controlled data to a PHP unserialize() call, plus a usable POP gadget chain in the theme, WordPress core, or an installed plugin to convert object injection into concrete impact - absent such a chain, the practical impact is limited. The CVSS vector's PR:N/UI:N implies no authentication or user interaction, but the description does not name the specific endpoint or parameter, so the unauthenticated-reachability claim is not independently verifiable. Limiting factors: the site must run the vulnerable IPharm theme version, and real-world code execution depends on gadget-chain availability rather than being guaranteed by the flaw alone. |
| Impact | The input assigns CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which on its face describes a remote, unauthenticated, low-complexity flaw with full confidentiality/integrity/availability impact. However, this is a CWE-502 PHP Object Injection issue in a WordPress theme, and the realized impact of object injection depends entirely on the presence of a usable POP (property-oriented programming) gadget chain in the theme, WordPress core, or an installed plugin - the raw CVSS:L/C:H/I:H/A:H rating assumes a weaponizable chain exists, which the sparse description does not confirm. No EPSS score was provided, there is no CISA KEV listing (not actively exploited per available data), and no public POC is referenced, so all three real-world exploitation signals are either absent or negative. This tempers the 9.8: it is a genuinely serious vulnerability class but currently shows no evidence of active or widespread exploitation, and its practical severity is gated on gadget-chain availability. EPSS is MISSING from the input and cannot be used; the single Patchstack reference is the only corroborating source. Net: treat as a high-priority patch for anyone running this specific theme, but the 9.8 likely overstates turnkey exploitability given the object-injection gadget-chain dependency. |
| Exploit ScenarioDerived | A remote attacker submits crafted, serialized PHP data to an input vector in the IPharm theme that reaches an unserialize() call, instantiating attacker-chosen objects. If a suitable POP gadget chain is present in the theme, WordPress, or a plugin, this object injection can escalate to file operations, SQL injection, or remote code execution. No public exploit code is identified at time of analysis, and successful exploitation is contingent on an available gadget chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
PHP object injection in the IPharm WordPress theme through version 1.2.4 can allow remote attackers to pass crafted serialized data into a PHP unserialize() path, potentially enabling object injection and, if a usable gadget chain exists in the theme, WordPress core, or installed plugins, full site compromise. The assigned CVSS score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but the independent assessment adjusts attack complexity to high because the specific vulnerable input vector is not identified and practical impact depends on gadget-chain availability. No public exploit was identified at time of analysis, and no CISA KEV confirmation was provided; authentication requirements from the CVSS vector are PR:N, but unauthenticated reachability is not independently verifiable from the available data.
RemediationAI
No vendor-released patch version is identified in the provided data at time of analysis. Because the issue is in a WordPress theme, the primary remediation is to deactivate and remove the IPharm theme at or below 1.2.4 and replace it with a maintained alternative; if the vendor later releases a version above 1.2.4, upgrade to that exact patched release and verify the changelog. If the theme cannot be removed immediately, restrict unauthenticated access to theme-specific endpoints and admin-ajax.php actions where feasible, deploy WAF rules to block serialized object patterns in request parameters, and monitor for exploit attempts, recognizing that WAF filtering may cause legitimate false positives and can be bypassed. Keeping the vulnerable theme active preserves a high-risk PHP object injection surface, while deactivation eliminates exposure but changes site presentation. The Patchstack advisory at https://patchstack.com/database/wordpress/theme/ipharm/vulnerability/wordpress-ipharm-theme-1-2-4-php-object-injection-vulnerability?_s_id=cve should be monitored for updated guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-502, Deserialization of Untrusted Data, in the ThemeREX Group IPharm WordPress theme. The CPE cpe:2.3:a:themerex_group:ipharm:*:*:*:*:*:*:*:* identifies the vendor/product as ThemeREX Group IPharm, with a wildcard version that is constrained by the description to releases through 1.2.4. In PHP, passing attacker-controlled data to unserialize() can instantiate arbitrary objects and trigger magic methods such as __wakeup or __destruct; impact depends on whether a POP gadget chain is reachable in the theme, WordPress core, or installed plugins. The assigned CVSS vector indicates network reachability, no privileges required (PR:N), and no user interaction (UI:N), while the independent assessment notes AC:H because the exact endpoint or parameter is not named and a usable gadget chain is required for concrete impact.
Know when Ipharm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network/unauthenticated per vector, but AC:H because PHP object injection requires a suitable POP gadget chain to achieve the high C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.
Executive ViewAI
The IPharm WordPress theme through version 1.2.4 contains a critical PHP object injection vulnerability that could allow remote compromise of affected WordPress sites when a usable gadget chain exists in the theme, core, or installed plugins. Although no public exploit has been identified and exploitation depends on specific gadget-chain conditions, the absence of a vendor patch and the public-facing nature of WordPress sites create material risk to site integrity, customer data, and brand trust. Leadership should prioritize discovery and interim mitigation for all sites running the affected theme, with particular attention to unauthenticated exposure per the CVSS vector even though reachability is not independently verified.
No vendor-released patch identified at time of analysis. Interim mitigations include deactivating or removing the IPharm theme, applying virtual patching or WAF rules for PHP object injection, restricting access to vulnerable endpoints, reducing installed plugins and themes to minimize gadget-chain risk, monitoring logs for serialized payloads, and isolating affected sites until a vendor fix is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB