CVE-2026-25360
Published: 25 March 2026
Summary
CVE-2026-25360 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-25360 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Vex WordPress theme developed by rascals, enabling PHP object injection. The issue affects all versions of the Vex theme prior to 1.2.9, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited remotely by an authenticated attacker with low privileges, such as a WordPress user with contributor-level access, requiring low attack complexity and no user interaction. Successful exploitation allows object injection, potentially leading to high-impact confidentiality, integrity, and availability violations, including arbitrary code execution, data manipulation, or denial of service on the targeted WordPress site.
Patchstack's advisory details the vulnerability and recommends updating the Vex theme to version 1.2.9 or later as the primary mitigation, which resolves the deserialization flaw. No additional workarounds are specified in the provided references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15684
Vulnerability details
Deserialization of Untrusted Data vulnerability in rascals Vex vex allows Object Injection.This issue affects Vex: from n/a through < 1.2.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE describes remote exploitation of a public-facing WordPress theme via PHP deserialization/object injection by a low-privileged authenticated user, directly enabling initial access via public app exploitation (T1190) and privilege escalation to arbitrary code execution (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the deserialization of untrusted data vulnerability by requiring timely patching of the Vex WordPress theme to version 1.2.9 or later.
Prevents object injection by validating untrusted inputs before deserialization in the vulnerable Vex theme.
Identifies the deserialization vulnerability in the Vex theme through ongoing vulnerability scanning and monitoring.