Juno WordPress Theme EUVD-2026-96491

The site must be running the ThemeRex 'Juno' WordPress theme at version 2.25 or earlier; per the CVSS vector (PR:N/UI:N) exploitation is unauthenticated and needs no user interaction against a default installation. The description does not name the specific vulnerable parameter, endpoint, or feature that performs the unsafe deserialization, so the exact trigger is unconfirmed. The primary limiting factor is that PHP Object Injection only achieves meaningful impact (RCE/file operations) when an exploitable POP gadget chain is reachable in the theme code or co-installed plugins; without such a gadget the injection may have reduced effect. Exploitation is further bounded to the subset of WordPress sites using this particular commercial theme at the affected versions.

All provided signals point the same direction on technical severity: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality, integrity, and availability impact, which is consistent with CWE-502 (unsafe deserialization / PHP Object Injection) typically yielding remote code execution when a suitable POP gadget chain is present. However, the exploitation-likelihood signals are entirely absent from the input: there is no EPSS score, no CISA KEV listing, and no indication of public POC or exploit code - so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. The practical result is a high-severity-but-unproven-exploitation issue: the vulnerability class is genuinely dangerous and unauthenticated, warranting prompt patching for any site running the Juno theme, but there is no evidence yet of active or widespread exploitation, and the real-world impact depends on whether an exploitable object-injection gadget chain exists in the theme or co-installed plugins (not confirmed in the input). Note the single reference points to a Patchstack database entry at the slug 'juno-theme-2-25' under the path 'theme/junotoys' - the 'junotoys' path fragment appears inconsistent with the product name 'Juno' and vendor 'themerex' and should be verified against the Patchstack advisory.

A remote, unauthenticated attacker sends a crafted HTTP request to a Juno-themed WordPress site, supplying a malicious serialized PHP object to an endpoint that deserializes untrusted input. If a usable property-oriented-programming (POP) gadget chain is available in the theme or loaded plugins, deserialization triggers attacker-controlled code or object behavior, potentially leading to remote code execution or site compromise. No public exploit code is identified in the provided data, so this scenario is inferred from the CWE-502 class and the AV:N/AC:L/PR:N CVSS vector rather than a demonstrated POC.