ThemeREX Jacqueline EUVD-2026-96526

Affected deployments are WordPress sites running the ThemeREX 'Jacqueline' theme at version 2.22 or earlier. Per the CVSS vector (PR:N/UI:N) exploitation is unauthenticated and requires no user interaction against the theme's default install. The practical limiting factor for PHP Object Injection (CWE-502) is that achieving the rated C:H/I:H/A:H impact generally depends on a usable POP gadget chain being present in the theme, WordPress core, or another installed plugin; without a reachable gadget the injection may fail to produce meaningful impact. Exploitation is further scoped to sites that actually have this specific theme installed and active.

All provided signals point the same direction on severity: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with full high impact to confidentiality, integrity, and availability (C:H/I:H/A:H), yielding the 9.8 Critical score, and CWE-502 (deserialization of untrusted data / PHP Object Injection) is consistent with that reachability. However, the exploitation-likelihood signals are entirely absent: no EPSS probability, no CISA KEV listing, and no POC was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No SSVC decision data was provided. The practical caveat for PHP Object Injection is that reaching the stated high impact typically requires a usable POP gadget chain in the theme, WordPress core, or an installed plugin; the raw 9.8 assumes a reachable chain exists, which the input does not confirm. Net: treat as a high-priority patch for sites running the Jacqueline theme because the entry point is unauthenticated and network-reachable, but recognize that real-world weaponization depends on gadget availability and that no exploitation telemetry (EPSS/KEV/POC) currently corroborates widespread attacks.

A remote, unauthenticated attacker sends a crafted request to a WordPress site running the ThemeREX Jacqueline theme (<= 2.22), supplying a malicious serialized PHP object to a vulnerable input that is deserialized. If a suitable POP gadget chain is present in the theme, core, or an installed plugin, the injected object triggers it on instantiation/destruction, potentially leading to code execution, data disclosure, or file manipulation. No POC was provided in the input, so exploitation here is inferred from CWE-502 and the AV:N/AC:L/PR:N/UI:N vector rather than from observed exploit code.