EUVD-2026-96198
GHSA-g269-mqp5-x3j6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach vulnerable deserialization input in Smash theme
-
DeliverySubmit crafted serialized PHP object
-
ExploitTrigger POP gadget chain on unserialize
-
ExecutionExecute attacker-controlled object methods
-
ImpactAchieve code execution or data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Smash theme (versions up to and including 1.12.0) deserialize attacker-controlled input via a PHP unserialize() call, AND that a usable POP gadget chain exists in the loaded WordPress core, theme, or plugin code to turn object injection into a meaningful impact - the single-line advisory does not name the specific parameter, endpoint, or sink. The CVSS vector asserts no authentication or user interaction (PR:N/UI:N), but this is an unverified Patchstack default; realistic limiting factors are the theme's small install base, the need for a reachable gadget chain, and the possibility that the vulnerable input is only accessible to authenticated users. No non-default configuration is documented as required. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores 9.8 Critical, describing a remote, unauthenticated, low-complexity PHP Object Injection via untrusted deserialization (CWE-502) in the ThemeREX Smash WordPress theme. However, the signal set is thin and partly conflicting with the stated metrics: there is no EPSS probability provided, no CISA KEV listing, and no public POC referenced, so this is no public exploit identified at time of analysis - not confirmed exploitation. The PR:N rating is a common Patchstack default for theme vulnerabilities and should be treated cautiously, because many WordPress object-injection flaws in practice require an authenticated session or a specific reachable sink/POP gadget chain that the one-line description does not confirm. Real-world priority is therefore moderate rather than critical-at-scale: the theoretical impact is severe (potential RCE/full compromise via gadget chains) but it is gated by the product's limited deployment footprint and by whether a usable POP chain exists in the installed plugin/theme stack. Treat as a patch-soon item for sites actually running Smash, not an emergency for the general population. |
| Exploit ScenarioDerived | An attacker submits crafted serialized PHP data to an input that the Smash theme passes to unserialize(), injecting a malicious object that triggers a property-oriented programming (POP) gadget chain present in the WordPress/theme/plugin code. If a usable gadget chain is reachable, this can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit code is identified at time of analysis, and the required POP gadget chain is not described in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
ThemeREX Smash WordPress theme through version 1.12.0 contains a PHP object injection vulnerability (CWE-502) that is triggered when untrusted data is deserialized. The published CVSS 3.1 vector scores 9.8 Critical (AV:N/AC:L/PR:N/UI:N), indicating remote, unauthenticated, low-complexity exploitation, but the independent assessment raises attack complexity to High because a usable POP gadget chain must exist in loaded WordPress core, theme, or plugin code, and the advisory does not name the vulnerable parameter, endpoint, or sink. No public exploit identified at time of analysis; limiting factors include the theme's install base, the need for a reachable gadget chain, and the possibility that the vulnerable input is only accessible to authenticated users.
RemediationAI
No vendor-released patch or fixed version is identified in the provided advisory; the Patchstack entry at https://patchstack.com/database/wordpress/theme/smash/vulnerability/wordpress-smash-theme-1-12-0-php-object-injection-vulnerability?_s_id=cve should be monitored for an update. Until a patched version is available, the most direct mitigation is to temporarily deactivate the Smash theme and replace it with a maintained alternative, accepting the associated site design and functionality changes. If the theme must remain active, restrict access to any theme-specific endpoints or AJAX actions that may pass input to unserialize() (for example, by requiring authentication or limiting by IP where operationally feasible), understanding that this may break front-end features and that the CVSS vector claims unauthenticated access (PR:N). Deploy a WAF rule that blocks PHP serialized object payloads (patterns such as O: and C: in request parameters) to routes handled by the theme, weighing the risk of false positives against legitimate serialized data. Reduce the available POP gadget chain surface by removing unused themes and plugins and keeping all remaining WordPress core, theme, and plugin code updated, though patching other components does not fix the Smash flaw itself. Monitor web server and application logs for requests containing serialized objects to theme endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a deserialization of untrusted data flaw (CWE-502) in the Smash WordPress theme. In PHP, passing attacker-controlled input to unserialize() can instantiate arbitrary objects and control their properties; without an application-specific gadget chain, object injection alone may not yield remote code execution, file deletion, or other high-impact outcomes. The affected product is identified by CPE cpe:2.3:a:themerex_group:smash:*:*:*:*:*:*:*:* and the Patchstack advisory states versions through 1.12.0 are affected. The single-line advisory does not disclose which theme parameter or endpoint passes data to the unsafe unserialize() call, so exploitation requires identifying a reachable sink and a POP chain composed of classes loaded in the WordPress environment. The input CVSS vector uses AV:N/AC:L/PR:N/UI:N, whereas the independent assessment keeps PR:N/UI:N but changes AC from Low to High to reflect the gadget-chain precondition; no non-default configuration is documented as required.
Know when Smash gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote and unauthenticated per the advisory, but AC:H because exploitation depends on a reachable POP gadget chain; impact is high on C/I/A given potential object-injection-to-RCE.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.
Executive ViewAI
The ThemeREX Smash WordPress theme, in all versions through 1.12.0, contains a critical PHP object injection flaw that could let an attacker take control of any website where the theme is active. Until the vendor releases a fix, every organization running this theme - including marketing, e-commerce, and public-facing sites - remains exposed, and a compromised WordPress site can be used to steal customer data, deface the brand, or pivot into internal networks. Leadership should treat this as an active exposure-management priority and decide within days whether to keep the theme live under compensating controls or remove it outright.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or uninstall the ThemeREX Smash theme (all versions through 1.12.0) where business use is not essential; apply WAF/reverse-proxy virtual patching to block untrusted deserialization input; restrict wp-admin, REST API, and theme-related endpoints to trusted networks; enforce MFA and least privilege for WordPress administrators; segment affected hosts from internal networks; and monitor PHP, web, and outbound traffic logs for object-injection or post-exploitation activity. Note: exploitation requires a reachable POP gadget chain and a vulnerable input path, and no public exploit has been identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB