CVE-2026-27084

CriticalRCE

Published: 25 March 2026

Published

25 March 2026

Modified

24 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0048 37.4th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-27084 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-27084 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the ThemeREX Buisson WordPress theme, enabling object injection. It affects all versions of Buisson from unspecified initial releases through 1.1.11. The issue carries a CVSS v3.1 base score of 9.8, reflecting its critical severity due to high impacts on confidentiality, integrity, and availability.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows arbitrary object injection, potentially leading to remote code execution, data manipulation, or system compromise on affected WordPress installations running the vulnerable theme.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/buisson/vulnerability/wordpress-buisson-theme-1-1-11-php-object-injection-vulnerability?_s_id=cve provides details on the PHP object injection flaw in Buisson version 1.1.11 and likely recommends updating to a patched version or applying available mitigations.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-15796

Vulnerability details

Deserialization of Untrusted Data vulnerability in ThemeREX Buisson buisson allows Object Injection.This issue affects Buisson: from n/a through <= 1.1.11.

CWE(s): CWE-502

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

CVE enables remote unauthenticated exploitation of a public-facing WordPress theme via PHP object injection (T1190), directly leading to RCE through command/script execution on the server (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0