Description
Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
Published: 2026-10-10
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an unauthenticated PHP Object Injection flaw that enables attackers to instantiate malicious PHP objects within the WordPress theme code. This flaw can allow arbitrary code execution on the affected server, compromising confidentiality, integrity, and availability of the site and potentially of the underlying host. The weakness is identified as CWE-502, which involves insecure deserialization.

Affected Systems

The issue affects the ThemeREX Jacqueline theme up to and including version 2.22. Any WordPress installation using these theme versions is potentially vulnerable. The specific vendor is ThemeREX, and the product is the Jacqueline theme.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical severity. No EPSS data is available, but the lack of an EPSS score does not diminish the potential impact. Since the flaw is unauthenticated and leverages PHP object injection through user input, an attacker can send crafted requests to a live site to trigger unserialization. The vulnerability is not listed in the CISA KEV catalog at this time.

Generated by OpenCVE AI on October 10, 2026 at 21:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Jacqueline theme to the latest available version, 2.23 or later.
  • If an immediate upgrade is not possible, remove or deactivate the Jacqueline theme from the WordPress installation to stop the vulnerable code from executing.
  • Monitor the site’s logs and traffic for anomalous PHP object serialization activity, and block any unauthorized object requests.

Generated by OpenCVE AI on October 10, 2026 at 21:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 11 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 10 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Description Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
Title WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-11T11:53:09.192Z

Reserved: 2026-08-24T17:28:20.060Z

Link: CVE-2026-78531

cve-icon Vulnrichment

Updated: 2026-10-11T11:49:15.455Z

cve-icon NVD

Status : Deferred

Published: 2026-10-10T20:16:46.830

Modified: 2026-10-13T13:29:12.567

Link: CVE-2026-78531

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-10T21:30:17Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data