EUVD-2026-96453
GHSA-cpgp-q9h2-r8v8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to WordPress site
-
DeliverySupply malicious serialized PHP object
-
ExploitTrigger unsafe deserialization (CWE-502)
-
ExecutionInvoke POP gadget chain
-
ImpactExecute code or compromise site
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be a WordPress installation running the Ancora Themes 'CleanSkin' theme at version 1.5.0 or earlier, exposing an endpoint that deserializes attacker-controlled input (CWE-502). Per the CVSS vector (PR:N/UI:N) exploitation is unauthenticated and requires no user interaction against reachable installations. The primary LIMITING factor is that PHP Object Injection yields meaningful impact (RCE/file operations/SQLi) only when an exploitable POP gadget chain is present in the theme, WordPress core, or co-installed plugins; without a reachable gadget chain, impact may be limited to the injection itself. A documented fixed version was not included in the provided data, so remediation hinges on upgrading past 1.5.0 once a patched release is confirmed with the vendor/Patchstack. |
| Impact | All provided signals point to a high-severity issue: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with full confidentiality, integrity, and availability impact (C:H/I:H/A:H), yielding a 9.8 base score, and CWE-502 (deserialization of untrusted data) is consistent with the 'PHP Object Injection' description. However, several real-world-risk signals are MISSING and must not be assumed: no EPSS exploitation-probability score was supplied, the vulnerability is NOT listed in CISA KEV, no public proof-of-concept was referenced, and no SSVC decision data was provided - so there is no public exploit identified at time of analysis. A practical caveat specific to CWE-502: PHP object injection is only exploitable to code-execution/file impact when a usable POP gadget chain exists in the theme, WordPress core, or another installed plugin; the raw 9.8 assumes worst-case gadget availability, so actual impact on a given site can be lower than the headline score. Net: this is a credible priority for any site running the affected theme because it is unauthenticated and network-reachable, but the absence of EPSS/KEV/POC data suggests it is not yet under observed mass exploitation - treat it as patch-promptly rather than emergency-active-exploitation. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running the CleanSkin theme (<= 1.5.0), supplying a serialized PHP payload to an endpoint that deserializes user input. If a suitable POP gadget chain is present in the theme or other installed components, deserialization is abused to achieve object injection leading to code execution, data theft, or site compromise. No public exploit code was referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in the Ancora Themes CleanSkin WordPress theme (versions up to and including 1.5.0) allows remote attackers to pass attacker-controlled serialized data into an endpoint that deserializes it, as reflected by a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vector confirms the attack is network-reachable, low-complexity, and requires neither authentication nor user interaction against reachable installations, though real-world impact hinges on the presence of a usable POP gadget chain in the theme, WordPress core, or co-installed plugins - without one, the outcome may be limited to the injection itself. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing was provided); the available data contains no documented fixed version.
RemediationAI
No vendor-released patch was identified at time of analysis, and the provided data does not name a fixed version, so the immediate action is to confirm the patched release with Ancora Themes and Patchstack (https://patchstack.com/database/wordpress/theme/cleanskin/vulnerability/wordpress-cleanskin-theme-1-5-0-php-object-injection-vulnerability) and upgrade to the first release above 1.5.0 as soon as it is published. In the interim, the most effective compensating control is to deactivate and remove the CleanSkin theme from production sites, switching to an actively maintained theme - the trade-off being an immediate change in site appearance and any theme-specific templates, widgets, or customizations that depend on it. If removal is not feasible, restrict the theme's exposed endpoints with a reverse proxy or WAF rule that rejects request bodies and parameters containing PHP serialization signatures (for example O:<length>:"<classname>") and blocks direct access to theme PHP files, accepting the risk of false positives on legitimate serialized data and the fact that encoding or obfuscation can evade pattern matching. Reducing the installed plugin and theme footprint lowers the probability that an exploitable POP gadget chain exists, and hardening PHP configuration with disable_functions for dangerous sinks plus strict file-write permissions on wp-content limits post-exploitation impact. Because the issue is unauthenticated and requires no user interaction, treat any site running version 1.5.0 or earlier as exposed until the theme is patched or removed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-502, deserialization of untrusted data, in a WordPress theme distributed by Ancora Themes and tracked under CPE cpe:2.3:a:ancorathemes:cleanskin:*:*:*:*:*:*:*:* (EUVD-2026-96453). In PHP, passing attacker-controlled input to unserialize() - or to a function that internally unserializes - lets the attacker instantiate arbitrary classes defined anywhere in the loaded codebase. Object injection by itself is only the primitive; the escalatory step is chaining the magic methods that PHP invokes automatically during deserialization (notably __wakeup, __destruct, and __toString) across classes present in the active theme, WordPress core, and every installed plugin, forming a POP (property-oriented programming) gadget chain that can translate into file writes, remote code execution, SQL injection, or option manipulation. This is precisely why the CVSS vector rates impact as C:H/I:H/A:H while the practical severity depends on the gadget surface of the specific site: a hardened install with a small plugin footprint may not expose a usable chain, whereas a heavily extended site likely does. The unauthenticated, no-interaction profile (PR:N/UI:N) means the vulnerable deserialization entry point is reachable directly over HTTP without any login or victim action.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network deserialization (PR:N/AV:N/AC:L, UI:N); C/I/A:H reflects worst-case object-injection-to-RCE when a POP gadget chain is available, consistent with the reporter's rating.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
Executive ViewAI
The CleanSkin theme for WordPress (versions through 1.5.0) contains a critical unauthenticated PHP object injection flaw that could allow remote attackers to compromise the confidentiality, integrity, and availability of affected public-facing websites. Organizations using this theme, especially those with internet-exposed WordPress installations, face potential data theft, site defacement, or use of their sites as a foothold for further attacks. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, but the severity and ease of network access make immediate mitigation a leadership priority.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove CleanSkin theme versions up to and including 1.5.0; if the theme must remain, use WAF/virtual patching to block PHP object injection payloads, restrict access to vulnerable endpoints, apply least-privilege WordPress hardening, and monitor for serialized data attacks or post-exploitation activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB