EUVD-2026-96510
GHSA-gfr5-mr4f-j8gp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site using Asia Garden theme
-
DeliveryCraft malicious serialized PHP payload
-
ExploitSubmit to vulnerable unserialize() endpoint
-
ExecutionTrigger POP gadget chain on deserialization
-
ImpactAchieve code execution / site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target WordPress site to be running the ThemeRex 'Asia Garden' theme at version 1.3.1 or earlier, which exposes an input that is passed to PHP unserialize() without sanitization (CWE-502). Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required against an affected installation. The key practical limiting factor is that PHP Object Injection yields meaningful impact (e.g., RCE, file operations) only when an exploitable POP gadget chain exists in the theme code, WordPress core, or an active plugin - absent such a chain, impact may be reduced to denial of service or be non-trivial to weaponize. The specific vulnerable parameter/endpoint is not detailed in the available data. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) scores 9.8 Critical, indicating remote, unauthenticated, low-complexity exploitation with full confidentiality, integrity, and availability impact - consistent with a CWE-502 PHP Object Injection flaw that can lead to arbitrary code execution via crafted serialized data. However, this near-maximal severity rating is NOT corroborated by exploitation-maturity signals: no EPSS score was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced (the sole Patchstack reference is an advisory page, not exploit code). No SSVC decision data (exploitation status, automatable, technical impact) was supplied. Therefore this presents as a high-theoretical-severity issue whose real-world exploitation likelihood is currently unquantified - PHP Object Injection is only exploitable in practice when a usable POP (property-oriented programming) gadget chain exists in the loaded code (the theme or WordPress core/plugins), which the description does not confirm. Treat as a genuine priority for anyone running the affected ThemeRex 'Asia Garden' theme, but recognize that the absence of EPSS/KEV/POC data means widespread automated exploitation is not demonstrated at time of analysis. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running the Asia Garden theme (<= 1.3.1), supplying malicious serialized PHP data to an input that is passed to unserialize(). If a suitable gadget chain is present in the theme, WordPress core, or active plugins, the injected object triggers unintended method calls during deserialization, potentially leading to remote code execution, file manipulation, or site takeover. No public proof-of-concept exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in the ThemeRex 'Asia Garden' WordPress theme (versions 1.3.1 and earlier) allows remote attackers to pass crafted serialized data into PHP's unserialize() and instantiate arbitrary objects on the target site. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical), exploitation requires no authentication or user interaction against an affected installation and could yield full confidentiality, integrity, and availability impact - typically arbitrary code execution, file manipulation, or SQL injection when a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (CISA KEV); no EPSS score was supplied. Practical exploitability hinges on the presence of a viable gadget chain, without which impact may drop to denial of service or be difficult to weaponize, and the exact vulnerable parameter/endpoint is not detailed in the available data.
RemediationAI
No vendor-released patch was identified at time of analysis, so the primary remediation is to remove or deactivate the vulnerable 'Asia Garden' theme from every WordPress installation where it is active - since the vulnerable code lives in the theme itself, deactivating it and switching to a maintained, security-reviewed theme fully eliminates the attack surface, at the cost of losing the site's intended appearance/customizations and any theme-specific shortcodes or blocks. If the theme must remain live, treat it as a temporary, accepted risk and compensate: place the site behind a WAF with rules for serialized-object payloads (O: or C: patterns) in request parameters, harden PHP by enabling the unserialize_callback_func/unserialize allowed_classes restrictions where the theme's code path can be intercepted, and audit all installed plugins and WordPress core for known POP gadget chains, since the practical severity of CWE-502 depends on their presence - removing unused plugins both shrinks the gadget surface and reduces the chance the flaw escalates to RCE. Because the vector is PR:N/UI:N, there is no authentication or user-interaction control that can be relied upon as a mitigation, so network exposure cannot be meaningfully reduced without removing or neutering the theme; monitor the Patchstack advisory at https://patchstack.com/database/wordpress/theme/asia-garden/vulnerability/wordpress-asia-garden-theme-1-3-1-php-object-injection-vulnerability?_s_id=cve for a fixed release and apply it as soon as it becomes available, and review server logs for anomalous serialized payloads (O:8:", O:%d:", base64 blobs) in query strings and POST bodies as a detection measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic CWE-502 Deserialization of Untrusted Data flaw in a PHP application - specifically a commercial WordPress theme. The theme exposes an input that is passed to PHP's unserialize() without adequate sanitization or an allowed-classes restriction. PHP object injection works because unserialize() can reconstruct arbitrary objects and invoke magic methods (__wakeup, __destruct, __toString) defined by the classes available in the runtime; an attacker who supplies a serialized payload shaped to match a gadget chain (POP chain) can chain those magic methods to reach sinks such as file writes, eval, or database queries, escalating a benign deserialization into remote code execution or SQL injection. The attack surface is the WordPress front end reachable over HTTP (CPE cpe:2.3:a:themerex:asia_garden:*:*:*:*:*:*:*:*, i.e. all versions through 1.3.1), and because the vector carries PR:N/UI:N, no credentials or victim interaction are needed. The decisive variable is the gadget environment: WordPress core and popular plugins ship many classes with useful magic methods, so on a typical site with plugins installed the chain is often achievable, while on a bare installation the impact may be limited to denial of service. The advisory originates from Patchstack's WordPress database, which is the canonical tracking channel for theme/plugin vulnerabilities of this kind.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states unauthenticated (PR:N, UI:N) remote object injection; CWE-502 object injection can yield full code execution, so AV:N/AC:L with C/I/A all High.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.
Executive ViewAI
Any internet-facing website running the ThemeRex 'Asia Garden' WordPress theme at version 1.3.1 or earlier is exposed to an unauthenticated attacker who may be able to seize control of the underlying web server without any credentials or user interaction. With a 9.8 Critical rating and no vendor fix available, this represents a direct threat to the confidentiality, integrity, and availability of customer data, site content, and any business systems hosted alongside the affected site. Leadership should treat every externally reachable property using this theme as an immediate remediation priority, while noting that successful exploitation depends on the presence of a usable gadget chain in the theme, WordPress core, or an active plugin.
No vendor-released patch identified at time of analysis; interim mitigations include disabling or removing the ThemeRex 'Asia Garden' theme entirely and replacing it with a maintained theme, fronting affected sites with a WAF configured for virtual patching against PHP object-injection and serialized-input patterns, placing affected installations behind authentication or IP allowlisting, reducing the available gadget-chain surface by patching WordPress core and removing unused or outdated plugins, and monitoring logs for anomalous serialized requests and indicators of post-exploitation activity until a vendor fix is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB