Education Center EUVD-2026-96516

Exploitation requires the ThemeRex Education Center WordPress theme at version 3.6.12 or earlier to be installed and active, and reaching the specific theme code path that deserializes attacker-controlled input via unserialize(). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed and the attack is network-remote against default installations. The principal limiting factor is realized impact: PHP object injection only escalates to code execution or significant integrity/availability damage when a usable POP gadget chain exists within the theme, WordPress core, or co-installed plugins - so the full C:H/I:H/A:H outcome depends on the gadgets available in a given deployment. The narrow installed base of this specific commercial theme further limits exposure to sites that run it.

All available signals point to a genuinely high-priority flaw, though several corroborating data points are missing. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated vulnerability with full confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with the 9.8 Critical score and with CWE-502 (deserialization of untrusted data), which in PHP commonly escalates to remote code execution through POP gadget chains. However, the richer exploitation signals are absent: there is no EPSS probability, no CISA KEV listing, and no indication of public proof-of-concept code in the provided data, so there is currently no public exploit identified at time of analysis. The practical severity of PHP object injection is also gadget-dependent - impact requires a usable gadget chain in the theme or its loaded dependencies/plugins, which the single Patchstack reference does not detail; the C:H/I:H/A:H rating should therefore be read as the worst-case potential rather than a confirmed RCE. Net assessment: treat as a real priority for any site running the affected ThemeRex Education Center theme because it is unauthenticated and network-facing, but note the exploitation-likelihood signals (EPSS/KEV/POC) are unavailable rather than confirmed low.

A remote, unauthenticated attacker submits a crafted request to a WordPress site running the ThemeRex Education Center theme (<= 3.6.12) containing a malicious serialized PHP object in a parameter that the theme passes to unserialize(). If a suitable POP gadget chain is reachable, the injected object triggers code execution, file operations, or data tampering during deserialization. No public proof-of-concept exploit is identified in the provided data at time of analysis.