EUVD-2026-96195
GHSA-jgqf-fvm7-46rr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach vulnerable theme endpoint
-
DeliveryDeliver crafted serialized PHP object
-
ExploitTrigger unserialize() object injection
-
ExecutionAbuse POP gadget chain
-
ImpactAchieve RCE or file tampering
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vulnerable Partiso theme (versions through 1.1.13) must be installed and active on the target WordPress site, and the attacker must reach a code path that deserializes attacker-controlled input via unserialize(). Per CVSS PR:N/UI:N exploitation requires no authentication and no user interaction against default installations. The decisive limiting factor is that PHP Object Injection only yields meaningful impact (RCE, file operations, SQLi) when a usable POP gadget chain is available in the theme, installed plugins, or WordPress core - without such a chain, practical impact is reduced despite the 9.8 rating; a specific fixed/patched version is not stated in the available data. |
| Impact | Signals are partially aligned but incomplete. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H → 9.8 Critical) describes a remotely reachable, unauthenticated PHP Object Injection with full CIA impact, which on paper is a top-tier priority. However, no EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is currently no evidence of active or imminent exploitation (no public exploit identified at time of analysis). Critically, PHP Object Injection (CWE-502) is only as dangerous as the POP gadget chains reachable in the running stack - the raw 9.8 assumes a usable chain exists, which is NOT confirmed by the description; absent a gadget chain the practical impact can be substantially lower than the headline score suggests. Offsetting the high CVSS is deployment footprint: Partiso is a single commercial WordPress theme, not a ubiquitous platform, so real-world attack surface is narrow. Net assessment: treat as a genuine high-priority patch for sites actually running the Partiso theme, but recognize the 9.8 likely overstates universal risk given unproven gadget-chain exploitability and limited prevalence. |
| Exploit ScenarioDerived | An attacker sends a crafted request to a Partiso-themed WordPress site carrying a serialized PHP object to a code path that calls unserialize() on attacker-controlled input. If a suitable POP gadget chain is present in the theme, plugins, or WordPress core, object instantiation is abused to achieve outcomes such as arbitrary file write/delete, SQL injection, or remote code execution. No authentication or user interaction is required per the CVSS vector, but no public exploit code is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
PHP object injection in the Partiso WordPress theme (ThemeREX Group) through version 1.1.13 allows unauthenticated remote attackers to pass attacker-controlled serialized data into unserialize(), which per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector requires no credentials and no user interaction on a default installation. The 9.8 severity reflects the theoretical worst case of high confidentiality, integrity and availability impact, but actual exploitation depends on the presence of a usable POP gadget chain in the theme, a co-installed plugin, or WordPress core - without such a chain the practical impact is materially lower. No vendor-released patch version is stated in the available data, and no public exploit code was identified at time of analysis; the issue was reported through Patchstack's vulnerability disclosure program.
RemediationAI
No vendor-released patch identified at time of analysis, and the available data states no fixed version for Partiso - absence of patch data is not confirmation that no update exists, so the first step is to check the ThemeREX/Partiso vendor channel and the Patchstack advisory at https://patchstack.com/database/wordpress/theme/partiso/vulnerability/wordpress-partiso-theme-1-1-13-php-object-injection-vulnerability?_s_id=cve for a newer release and apply it the moment it appears. Where the theme is not the active front-end theme, deactivate and delete it entirely - this removes the attack surface with no functional cost, though a child theme or templates that depend on it will break if it is still referenced. If the theme must remain active, reduce the gadget-chain surface by deactivating and deleting unused plugins (each removed plugin class that exposes a __destruct/__wakeup sink lowers exploitability), accepting that plugin cleanup may break site features. Front-end and application-layer WAF rules that block serialized-object patterns (for example O: followed by a class-name and length prefix) in query strings, POST bodies and cookies can interrupt common delivery paths, but they are signature-based, can produce false positives on legitimate serialized payloads, and cannot cover every code path that reaches unserialize(). Additionally, restrict the reachable attack surface by placing the site behind authentication or IP allow-listing during maintenance windows where operationally feasible, and monitor web logs for requests containing serialized payloads as a detection measure, understanding that these compensating controls reduce rather than eliminate risk until a patched theme version is confirmed and deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-502, Deserialization of Untrusted Data, implemented in the WordPress context as PHP Object Injection. WordPress themes written in PHP frequently pass user-supplied data - request parameters, cookie values, or stored option data - into PHP's unserialize(), which reconstructs arbitrary objects and triggers PHP magic methods such as __wakeup(), __destruct() and __toString(). An attacker who controls the serialized string can instantiate objects of classes that are already loaded in the request and drive them down the gadget chains (POP chains) those classes expose. PHP Object Injection itself does not grant code execution: the decisive factor is whether the loaded code base - the Partiso theme itself, any active plugin, or WordPress core - exposes a chain terminating in a dangerous sink such as file write, file delete, SQL query construction, or call_user_func()/eval(). The CPE cpe:2.3:a:themerex_group:partiso:*:*:*:*:*:*:*:* uses a wildcard version, indicating that all Partiso releases up to and including 1.1.13 are considered affected rather than a bounded version range. Because the CVSS vector is AV:N/PR:N/UI:N, the vulnerable deserialization sink is treated as reachable directly over the network without authentication or victim interaction.
Know when Partiso gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote, unauthenticated, no-interaction deserialization gives AV:N/AC:L/PR:N/UI:N; object injection plausibly enables full RCE-level impact, so C:H/I:H/A:H, though a gadget chain is assumed.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.
Executive ViewAI
The Partiso WordPress theme (versions through 1.1.13) from ThemeREX Group contains a critical unauthenticated PHP object injection vulnerability that could allow remote attackers to fully compromise affected websites. Organizations using this theme on public-facing WordPress sites are at risk of data theft, site defacement, or complete takeover, and no vendor-released patch is currently identified. Leadership should prioritize identifying exposed sites and implementing interim mitigations to prevent potential exploitation.
Disable or remove the vulnerable Partiso theme. Deploy WAF rules to block serialized data in requests. Keep WordPress core and plugins updated to reduce gadget chain availability. Monitor logs for suspicious unserialize activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB