Description
Deserialization of Untrusted Data vulnerability in ThemeREX Solaris solaris allows Object Injection.This issue affects Solaris: from n/a through <= 2.5.
Published: 2026-03-05
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A flaw in the Solaris theme from ThemeREX deserializes data supplied by users without proper validation, permitting PHP object injection. The vulnerability can lead attackers to execute arbitrary code in the context of the WordPress site. The issue is especially dangerous because it does not require authentication and can be triggered through normal theme functionality.

Affected Systems

The Solaris theme is vulnerable in all releases from the earliest build through version 2.5, inclusive. Any WordPress installation that uses ThemeREX Solaris 2.5 or earlier is susceptible, regardless of the WordPress core version.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.8, indicating critical severity. EPSS shows a probability of exploitation below 1%, and the flaw is not yet listed in the CISA KEV catalog. Attackers can exploit the flaw by sending a crafted serialized object to a page in the theme that invokes PHP's unserialize(), which is exposed via the web interface. No authentication is needed; the likely attack vector is remote, but this is inferred from the lack of authentication requirement.

Generated by OpenCVE AI on April 16, 2026 at 12:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest version of the ThemeREX Solaris theme that contains the deserialization fix (e.g., version 2.6 or newer).
  • If an immediate update is not feasible, remove or disable the Solaris theme to eliminate the vulnerable code path from the site.
  • Sanitize or block any data that is passed to PHP's unserialize() function; avoid deserializing input from untrusted sources.

Generated by OpenCVE AI on April 16, 2026 at 12:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Mar 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 06 Mar 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Themerex
Themerex solaris
Wordpress
Wordpress wordpress
Vendors & Products Themerex
Themerex solaris
Wordpress
Wordpress wordpress

Thu, 05 Mar 2026 06:15:00 +0000

Type Values Removed Values Added
Description Deserialization of Untrusted Data vulnerability in ThemeREX Solaris solaris allows Object Injection.This issue affects Solaris: from n/a through <= 2.5.
Title WordPress Solaris theme <= 2.5 - PHP Object Injection vulnerability
Weaknesses CWE-502
References

Subscriptions

Themerex Solaris
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-01T14:13:54.121Z

Reserved: 2026-01-07T13:43:49.724Z

Link: CVE-2026-22454

cve-icon Vulnrichment

Updated: 2026-03-10T13:45:06.867Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-05T06:16:19.707

Modified: 2026-03-10T18:18:11.183

Link: CVE-2026-22454

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T13:00:11Z

Weaknesses