Cyber Resilience

CVE-2026-23542

CriticalRCE

Published: 19 February 2026

Published
19 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0039 30.8th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-23542 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-23542 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Grand Restaurant WordPress theme developed by ThemeGoods, specifically the grandrestaurant component. Published on 2026-02-19, it enables Object Injection and affects all versions from an unspecified starting point through 7.0.10. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for severe impacts.

An unauthenticated remote attacker can exploit this vulnerability over the network with low attack complexity and without requiring user interaction. By supplying untrusted data for deserialization, the attacker can achieve object injection, leading to high confidentiality, integrity, and availability impacts, such as arbitrary code execution or system compromise on affected WordPress installations using the vulnerable theme version.

The primary advisory from Patchstack, available at https://patchstack.com/database/Wordpress/Theme/grandrestaurant/vulnerability/wordpress-grand-restaurant-theme-7-0-10-php-object-injection-vulnerability?_s_id=cve, documents the PHP Object Injection issue in Grand Restaurant theme version 7.0.10 and provides details on mitigation, including available patches for affected users.

OWASP Top 10 for Web (2025)

A08:2025 Software or Data Integrity Failures

EU & UK References

Vulnerability details

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.10.

CWE(s)
CWE-502

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Direct unauthenticated RCE via deserialization in public-facing WordPress component maps cleanly to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-62368Shared CWE-502
CVE-2025-68903Shared CWE-502
CVE-2025-67911Shared CWE-502
CVE-2025-54014Shared CWE-502
CVE-2026-22505Shared CWE-502
CVE-2025-53078Shared CWE-502
CVE-2026-43633Shared CWE-502
CVE-2025-60039Shared CWE-502
CVE-2026-25429Shared CWE-502
CVE-2025-7697Shared CWE-502

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the deserialization vulnerability by requiring timely remediation through patching of the affected Grand Restaurant theme versions up to 7.0.10.

SI-10 Information Input Validation good match
prevent

Prevents object injection by enforcing validation of untrusted data inputs before deserialization in the PHP-based WordPress theme component.

SI-3 Malicious Code Protection partial match
preventdetect

Provides protection against malicious code execution resulting from successful exploitation of the object injection vulnerability.

References