{"id":"CVE-2026-81797","published":"2026-10-10T20:16:47Z","modified":"2026-10-13T13:29:12Z","title":"Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions","vendor":"ThemeRex","product":"Buzz Stone | Magazine & Viral Blog WordPress Theme","tier":"core","eol":null,"description":{"text":"Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.","provenance":"source","from":"NVD"},"summary":{"text":"The Buzz Stone | Magazine & Viral Blog WordPress Theme from ThemeRex contains an unauthenticated PHP object injection flaw, classified as deserialization of untrusted data, affecting the theme at version 1.0.2 and earlier. An attacker who can reach the affected site over the network can exploit it without credentials or any user interaction, as the attack vector is network-reachable, with low complexity, no privileges required and no user involvement.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:20:36Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00311,"percentile":0.2396,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/buzzstone/vulnerability/wordpress-buzz-stone-magazine-viral-blog-wordpress-theme-theme-1-0-2-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-96531","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-96531","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81797","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":11.7,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":4.79,"detail":"percentile 0.2396"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}