EUVD-2026-96519
GHSA-gpxw-g22x-43pr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to theme endpoint
-
DeliveryInject malicious serialized PHP object
-
ExploitTrigger unsafe deserialization (CWE-502)
-
ExecutionInvoke POP gadget chain
-
ImpactExecute code or manipulate data on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target WordPress site to be running the FC United theme (axiomthemes) at version 1.1.1 or earlier and to expose the vulnerable deserialization entry point to unauthenticated requests. The CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is needed to reach the flaw. The principal LIMITING factor is inherent to CWE-502 PHP Object Injection: achieving meaningful impact (code execution, file write, SQLi) depends on a reachable POP gadget chain in the theme, WordPress core, or an installed plugin - on a site lacking such a chain, the injection may not yield code execution despite the 9.8 score. Exposure is further bounded by the theme's limited deployment footprint. |
| Impact | All severity signals here are theoretical rather than empirical. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) describes a remotely reachable, unauthenticated flaw requiring no user interaction, which on paper is maximal severity. However, the only exploitation signals present are the CVSS vector and the CWE-502 classification - there is NO EPSS score, NO CISA KEV listing, and NO public proof-of-concept in the provided data, so there is no public exploit identified at time of analysis. A critical caveat for CWE-502 PHP Object Injection: the 9.8 rating assumes a usable POP (property-oriented programming) gadget chain is reachable in the theme, WordPress core, or co-installed plugins; without such a chain the real-world impact can be substantially lower than the vector implies. This tempers the raw score: it is a genuine priority for sites running the FC United theme, but the 9.8 reflects worst-case gadget availability rather than confirmed arbitrary code execution. Netting out: treat as high-priority patching for affected installations, but the absence of EPSS/KEV/POC suggests it is not under mass exploitation, and the niche footprint of the theme further narrows real-world exposure. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a vulnerable endpoint of a WordPress site running the FC United theme (<= 1.1.1), supplying a serialized PHP object in an unsanitized parameter. If a suitable gadget chain exists in the theme, WordPress core, or an installed plugin, deserialization triggers it to achieve outcomes such as arbitrary file operations, SQL injection, or remote code execution. No public PoC is referenced, so weaponization currently requires the attacker to identify a viable gadget chain themselves. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in the FC United WordPress theme (Axiom Themes, versions up to and including 1.1.1) allows remote attackers to pass crafted serialized input that the theme unserializes without validation, potentially leading to code execution, file manipulation, or database compromise depending on the gadget chains available on the host site. The 9.8 CVSS score reflects a fully remote, unauthenticated attack path with no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but there is no public exploit identified at time of analysis and no CISA KEV listing; all severity signals are theoretical rather than empirical. Real-world impact is further bounded by CWE-502's dependency on a reachable POP gadget chain in the theme, WordPress core, or an installed plugin, and by the theme's limited deployment footprint.
RemediationAI
Vendor-released patch: no vendor-released patch identified at time of analysis - the only reference supplied is the Patchstack advisory, which does not state a fixed version, so verify the current FC United release on the Axiom Themes distribution channel and the Patchstack advisory before assuming a fix exists. The most reliable immediate action is to deactivate and remove the FC United theme if it is not required; a theme is not needed for the front end once an alternative theme is activated, so the only trade-off is loss of the FC United styling and templates. If the theme must remain installed, deactivating it (rather than merely switching the active theme) removes the vulnerable code path from the request lifecycle while preserving files for later re-activation. Block or inspect requests carrying PHP serialized object syntax (payloads beginning with O: followed by a class name, or containing __PHP_Incomplete_Class) at a reverse proxy or WAF on parameters handled by the theme - this is a compensating control only, is prone to bypass via encoding, and can cause false positives on legitimate serialized data. Additional hardening that reduces gadget availability without a patch: keep WordPress core and all plugins current, remove unused plugins (each installed plugin expands the POP gadget surface), and disable any auto-updating or file-editing features that could turn a gadget chain into persistent code execution. Monitor web and PHP logs for serialized payloads referencing unexpected class names and for anomalous file writes in wp-content, and treat any such event as a compromise requiring incident response. Re-check the advisory URL above for a patched theme version, since the absence of a confirmed fix is a gap in the available data rather than proof that none exists.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The underlying flaw is CWE-502 (Deserialization of Untrusted Data) in a PHP/WordPress context. The FC United theme by Axiom Themes (CPE cpe:2.3:a:axiomthemes:fc_united, all versions up to 1.1.1) passes attacker-influenced input into PHP's unserialize() logic, or an equivalent deserialization path, without sufficient validation, type checking, or use of the safe json_decode/serialize alternatives. PHP object injection is not automatically equivalent to remote code execution: the attacker controls the serialized byte stream, but meaningful impact requires a magic method (__wakeup, __destruct, __toString, etc.) reachable through a POP gadget chain present somewhere in the loaded codebase - the theme itself, WordPress core, or any active plugin. If such a chain exists, the attacker may achieve arbitrary file write, SQL injection, or code execution in the web server's context; if no chain is reachable, the injection may only produce object instantiation side effects. The CVSS vector confirms a network-reachable, unauthenticated entry point with no UI interaction, consistent with a theme-registered AJAX action, REST route, or form handler that is exposed to anonymous visitors. WordPress themes run in the same PHP process as plugins and core, which is why deserialization flaws in themes are treated as high severity despite the theme's narrower install base.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote request reaches the sink (AV:N/PR:N/UI:N/AC:L); object injection can yield full code execution given a gadget chain, so C/I/A:H, scope unchanged within the PHP process.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
Executive ViewAI
The FC United WordPress theme (Axiom Themes, versions up to and including 1.1.1) contains a critical unauthenticated PHP object injection vulnerability (CVE-2026-66565, CVSS 9.8) that could allow remote attackers to execute code, manipulate files, or compromise the database on affected sites. Although no public exploit identified at time of analysis and no active exploitation has been confirmed, the absence of a vendor patch means any organization using this theme is exposed to a potentially severe breach if a gadget chain is present. Leadership should prioritize identifying all instances of this theme and assess the risk to their web presence, as a successful attack could lead to data loss, defacement, or full site takeover.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling or removing the FC United theme (Axiom Themes) versions up to and including 1.1.1, deploying a web application firewall (WAF) with rules to detect and block PHP object injection attempts, restricting access to affected sites through IP allowlisting or additional authentication layers, and closely monitoring for vendor updates or patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB