{"id":"CVE-2026-78535","published":"2026-10-10T20:16:47Z","modified":"2026-10-13T13:29:12Z","title":"Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions","vendor":"ThemeRex","product":"Photolia","tier":"core","eol":null,"description":{"text":"Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.","provenance":"source","from":"NVD"},"summary":{"text":"The Photolia WordPress theme by ThemeRex, versions 1.0.3 and earlier, contains an unauthenticated PHP object injection flaw caused by deserialization of untrusted data. An attacker with network access can exploit it without authentication or user interaction, with no special configuration required, to potentially compromise confidentiality, integrity, and availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:24:55Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00328,"percentile":0.25974,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":10,"pulses":[{"name":"Known_Cve | Oct 21, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad781365a703b9c48649e66","created":"2026-10-20"},{"name":"Known_Cve | Oct 20, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad62f6910d6449918d5e634","created":"2026-10-19"},{"name":"Known_Cve | Oct 19, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad4dda86020bf504fd274dd","created":"2026-10-18"},{"name":"Known_Cve | Oct 18, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad38c282daff94afd324191","created":"2026-10-17"},{"name":"Known_Cve | Oct 17, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad23ab08ed96f8b8bdea241","created":"2026-10-16"},{"name":"Known_Cve | Oct 16, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ad0e933fc9a5a47b66d7921","created":"2026-10-15"},{"name":"Known_Cve | Oct 15, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6acf9878b4135e4a2037eb34","created":"2026-10-14"},{"name":"Known_Cve | Oct 14, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ace4672cf606a4598005652","created":"2026-10-13"},{"name":"Known_Cve | Oct 13, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6accf72a849f791bc729312a","created":"2026-10-12"},{"name":"Known_Cve | Oct 12, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6acba8aca71285f9db866402","created":"2026-10-11"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/photolia/vulnerability/wordpress-photolia-theme-1-0-3-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-96530","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-96530","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78535","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":14.4,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":5.19,"detail":"percentile 0.2597"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.36,"detail":"10 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}