EUVD-2026-96474
GHSA-x86c-hv43-ww72
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress endpoint over HTTP
-
DeliverySubmit crafted serialized PHP object
-
ExploitTrigger unsafe deserialization (CWE-502)
-
ExecutionInvoke POP gadget chain
-
ImpactExecute code or tamper with site
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target WordPress site to have the ThemeRex Splendour theme version 1.23 or earlier installed and active, exposing the vulnerable deserialization entry point to unauthenticated HTTP requests (CVSS PR:N/UI:N indicates no authentication or user interaction needed). The realistic limiting factor for PHP Object Injection is the availability of a usable POP gadget chain in the theme, co-installed plugins, or WordPress core - without a reachable gadget, impact may be reduced from full RCE to lesser effects; exploitation is further bounded by the narrow deployment footprint of this specific theme. |
| Impact | The input CVSS vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, network-reachable, low-complexity flaw with full CIA impact (C:H/I:H/A:H), consistent with the 9.8 score and the CWE-502 deserialization class, which when it reaches a usable POP gadget chain typically yields remote code execution. However, the raw CVSS is the only strong signal here: no EPSS score, no CISA KEV entry, and no public exploit were provided, so exploitation status is 'no public exploit identified at time of analysis.' The practical severity of PHP Object Injection depends heavily on whether a suitable gadget chain exists in the theme or co-installed plugins/WordPress core - the single Patchstack reference does not confirm a working RCE chain, so the 9.8 represents worst-case potential rather than demonstrated impact. Net assessment: treat as a high-priority patch for any site running the Splendour theme because it is unauthenticated and the product is end-user-facing, but the absence of EPSS/KEV/POC data means there is no evidence of active or at-scale exploitation, and the real-world footprint of this specific theme is small. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running the Splendour theme (<= 1.23), supplying a serialized PHP object to a vulnerable deserialization sink. If a usable gadget chain is present in the theme, installed plugins, or WordPress core, object instantiation triggers code execution, file operations, or data tampering. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in the ThemeRex Splendour WordPress theme (versions 1.23 and earlier) lets remote attackers pass crafted serialized data into an unsafe deserialization routine, which can lead to remote code execution, arbitrary file manipulation, or full site takeover if a usable gadget chain is reachable. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-502 Deserialization of Untrusted Data; the vector confirms the entry point is reachable over the network with no authentication and no user interaction. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited, so real-world impact hinges on the presence of a POP gadget chain in the theme, co-installed plugins, or WordPress core, and on the narrow deployment footprint of this specific commercial theme.
RemediationAI
No vendor-released patched version is identifiable from the provided data, so the first step is to check the Patchstack advisory at https://patchstack.com/database/wordpress/theme/splendour/vulnerability/wordpress-splendour-theme-1-23-php-object-injection-vulnerability and the ThemeRex vendor channel for a fixed Splendour release and upgrade as soon as one is published; until then, deactivate and remove the theme from the affected site, which eliminates the attack surface entirely at the cost of losing the site's current look and layout (export customisations and templates first). If removal is not operationally possible, layer compensating controls: deploy a WAF rule that rejects requests containing PHP serialization markers such as 'O:' followed by a digit and a class name in query strings, POST bodies, cookies, and headers; block or rate-limit HTTP requests to the theme's vulnerable deserialization endpoint, accepting that legitimate theme features calling that endpoint may break; and restrict access to the theme directory via web server rules where feasible. Place the site behind a reverse proxy or CDN with request inspection, enable logging and alerting for serialized-object payload patterns, and monitor for post-exploitation indicators such as unexpected admin users, modified PHP files, or outbound connections from the web root. If no fix is forthcoming, migrate to a maintained alternative theme and assume any site that ran 1.23 or earlier while publicly reachable should be treated as potentially compromised pending a file-integrity and malware review.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-502: PHP object injection arising from passing attacker-controlled input to PHP's unserialize() (or an equivalent deserialization path) inside the ThemeRex Splendour theme code. When untrusted serialized strings are deserialized, PHP instantiates arbitrary objects and triggers magic methods such as __wakeup(), __destruct(), or __toString(); chaining these via a 'POP gadget chain' can escalate a benign-looking object graph into file writes, SQL execution, or command execution. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms the vulnerable entry point is reachable remotely with no privileges (PR:N) and no victim interaction (UI:N), and the impact scope is confined to the WordPress installation (S:U), which is consistent with the CPE entry cpe:2.3:a:themerex:splendour:*:*:*:*:*:*:*:* covering all released versions up to and including 1.23. Patchstack reported and catalogued this as a WordPress theme vulnerability under its PHP, WordPress, Deserialization, and WordPress Theme tags. The critical qualifier is gadget availability: PHP object injection only delivers full remote code execution when a reachable chain exists across the theme's autoloaded classes, installed plugins, or WordPress core; without one, the realised impact may degrade to data disclosure, file deletion, or denial of service rather than RCE.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization (AV:N/AC:L/PR:N/UI:N); PHP Object Injection with a gadget chain plausibly yields full RCE, justifying C:H/I:H/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
Executive ViewAI
The ThemeRex Splendour WordPress theme (versions 1.23 and earlier) contains an unauthenticated deserialization flaw rated CVSS 9.8 that could allow an external attacker to execute code and seize full control of any website running it. Because the entry point requires no credentials or user interaction, any internet-facing site using this commercial theme is exposed, and a successful compromise could mean defaced or hijacked web properties, customer data loss, and downstream reputational and regulatory consequences. Exposure is limited to the relatively narrow set of organizations that deployed this specific theme, but for those organizations the potential impact is complete - the theme's absence of a vendor fix means risk cannot be closed by patching today.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the theme if it is not business-essential; if it must remain live, isolate affected sites behind a WAF/reverse proxy that inspects and blocks crafted serialized PHP object payloads in request parameters; restrict and monitor administrative and file-write activity; deploy file-integrity monitoring to detect unexpected changes; review co-installed plugins and WordPress core for reachable POP gadget chains; review web and application logs for deserialization attempts; rotate credentials and salts on potentially exposed instances; and plan migration to a maintained alternative theme if no vendor fix is issued.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB