Let's Play Theme EUVD-2026-96194

Exploitation requires that the target WordPress site run the ThemeREX 'Let's Play' (playhockey) theme at version 1.1.15 or earlier, and that attacker-controlled data reach a PHP unserialize() call within the theme's code. The practical limiting factor is the availability of a POP (property-oriented programming) gadget chain in the theme, installed plugins, or WordPress core - PHP Object Injection yields meaningful impact only when such a chain exists to be triggered during object deserialization; without it, injection may be inert. Per the provided CVSS vector (PR:N/UI:N), no authentication or user interaction is indicated, so exploitation would be unauthenticated against affected installations. No vendor-confirmed fixed version was provided, so remediation may require removing or replacing the theme pending a patch.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, unauthenticated, low-complexity flaw with full confidentiality/integrity/availability impact - the theoretical worst case for a WordPress theme. The vulnerability class (CWE-502, PHP Object Injection via deserialization of untrusted data) is consistent with that network vector. However, several real-risk signals are MISSING from the provided data: no EPSS score, no CISA KEV listing, and no POC indicator were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. A critical caveat specific to this bug class: PHP Object Injection is only practically exploitable to RCE/full impact when a usable POP gadget chain exists in the theme or an accompanying plugin/core; absent a confirmed gadget chain the realized impact may be far lower than the 9.8 implies, so the headline score likely represents worst-case potential rather than demonstrated end-to-end compromise. Net assessment: treat as a high-priority patch candidate for any site actually running this theme because exploitation would be unauthenticated, but the low deployment footprint of this niche sports/hockey theme and the absence of exploitation signals (EPSS/KEV/POC) argue against this being a widespread, opportunistically-exploited emergency.

A remote, unauthenticated attacker sends a crafted request to a WordPress site running the ThemeREX 'Let's Play' (playhockey) theme ≤1.1.15, supplying attacker-controlled serialized PHP data to an input that is passed to unserialize(). If a suitable POP gadget chain is reachable, the injected object triggers arbitrary file operations or code execution during object destruction/wakeup, leading to site compromise. No public exploit code was identified at time of analysis.