EUVD-2026-96518
GHSA-fwhr-3chv-3fvp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach vulnerable ShiftCV endpoint
-
DeliverySubmit crafted serialized PHP object
-
ExploitTrigger unsafe deserialization (CWE-502)
-
ExecutionInvoke POP gadget chain
-
ImpactExecute code or manipulate site data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target WordPress site to be running the ShiftCV theme at version 3.0.14 or earlier, with a request path that reaches the vulnerable deserialization sink; per the provided CVSS vector (PR:N, UI:N) exploitation is unauthenticated and needs no user interaction against a default install. The practical LIMITING factor for PHP Object Injection is that a usable POP gadget chain must exist in the theme, WordPress core, or an installed plugin to escalate from object injection to meaningful impact such as code execution - absent a reachable chain, real-world impact is reduced. No non-default configuration toggle is cited in the available data. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical) is internally consistent with the description: an unauthenticated, network-reachable PHP Object Injection (CWE-502) flaw that typically yields remote code execution once a suitable POP gadget chain is reachable, hence the full C/I/A High rating. However, several decision signals are MISSING from the input: no EPSS probability, no CISA KEV listing, and no POC indicator are provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This means the 9.8 reflects theoretical worst-case impact rather than demonstrated real-world exploitation. A key caveat for PHP Object Injection specifically: AC:L assumes a usable gadget chain exists in the theme, WordPress core, or an installed plugin - without a confirmed chain the practical impact can range from benign to full RCE, which the raw score does not capture. Net: treat as a high-priority patch for any site actually running ShiftCV <= 3.0.14, but the absence of EPSS/KEV/POC data means this is credibility-of-impact high, confirmed-exploitation unknown, rather than a confirmed in-the-wild emergency. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request to a WordPress site running the ShiftCV theme (<= 3.0.14) containing a serialized PHP object in a parameter the theme deserializes. If a POP gadget chain is reachable in the theme, core, or an active plugin, deserialization triggers attacker-controlled method calls that can lead to code execution, file operations, or data compromise. No POC was referenced in the provided data, so weaponization depends on an available gadget chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in the ThemeREX ShiftCV WordPress theme, affecting versions up to and including 3.0.14, lets remote attackers feed crafted serialized input into an unsafe deserialization sink, which can escalate to remote code execution when a usable POP gadget chain is reachable in the theme, WordPress core, or an installed plugin. The flaw carries a 9.8 Critical rating (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication and no user interaction are required and successful exploitation can fully compromise confidentiality, integrity and availability. There is no public exploit identified at time of analysis and no CISA KEV confirmation, so the practical limiting factor is the availability of a reachable gadget chain rather than the injection primitive itself; no EPSS score was supplied in the available intelligence.
RemediationAI
No vendor-released patch is identified in the available intelligence, so the immediate action is to stop running the vulnerable theme: deactivate and remove ShiftCV 3.0.14 or earlier and migrate to a maintained alternative - the trade-off is loss of the theme's layout and customizations, which must be rebuilt or exported beforehand. If the theme cannot be removed straight away, apply virtual patching at the edge or WAF layer (for example Patchstack's virtual patches or custom rules) that block request bodies and parameters containing PHP serialization markers such as 'O:' followed by a class name or 'a:' array sequences before they reach the theme's deserialization sink; the trade-off is potential false positives against legitimate form or cookie data and the need to tune rules per site. Reduce the exploitable gadget surface by keeping WordPress core, all plugins and the active theme fully updated and by deactivating and deleting plugins that are not in use, since every unused plugin with magic methods (__wakeup, __destruct, __toString) is a potential POP chain component - the trade-off is loss of functionality from removed plugins. Monitor web server and WAF logs for serialized-object payloads on theme endpoints and treat any hits as attempted compromise, and verify no webshells or modified files were dropped if a payload is believed to have executed. Consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/shift-cv/vulnerability/wordpress-shiftcv-theme-3-0-14-php-object-injection-vulnerability?_s_id=cve for any later fix release, and re-check for a patched theme version before considering the site remediated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-502 (Deserialization of Untrusted Data) in a PHP context means attacker-controlled data reaches an unserialize() call without adequate validation or an allowed-classes restriction. When PHP reconstructs objects from that input it automatically invokes magic methods on the instantiated classes - __wakeup(), __destruct(), __toString(), __call() - and by chaining these methods across classes an attacker can build a 'POP gadget chain' (Property-Oriented Programming) that turns inert object construction into file writes, arbitrary method calls, or code execution. The CPE cpe:2.3:a:themerex:shiftcv:*:*:*:*:*:*:*:* identifies the affected package as the ShiftCV theme published by ThemeREX in the WordPress ecosystem, with the advisory narrowing the vulnerable range to 3.0.14 and earlier. Because WordPress themes and plugins share a single PHP process, gadget classes need not come from ShiftCV itself: any installed plugin or core version carrying a suitable magic-method chain widens the exploitation surface, which is why the CVSS vector scores full C/I/A impact (C:H/I:H/A:H) despite the injection sink being one component. The vulnerability was reported through Patchstack's WordPress vulnerability database, the standard disclosure channel for themes and plugins distributed outside the WordPress.org directory.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable object injection (PR:N/AV:N/UI:N); AC:L and full C/I/A:H reflect the typical RCE outcome of CWE-502 when a gadget chain is present.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
Executive ViewAI
ThemeREX ShiftCV, a WordPress theme used on affected sites through version 3.0.14, carries a critical unauthenticated deserialization flaw that could let an attacker fully compromise a vulnerable website if a usable gadget chain is present. Because no vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, leadership should treat exposed WordPress properties as at elevated risk of site takeover, data exposure, and service disruption until the theme is removed or mitigated.
No vendor-released patch identified at time of analysis. Interim mitigations include deactivating or removing ThemeREX ShiftCV 3.0.14, blocking serialized PHP object input at the WAF/edge, applying virtual patching if available, restricting access to vulnerable endpoints, monitoring for exploitation attempts, and isolating affected WordPress sites until a vendor fix is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB