Quirky WordPress theme: PHP Object Injection in versions up to 1.23
Summary
The Quirky WordPress theme in versions up to and including 1.23 contains a PHP Object Injection vulnerability (CWE-502). An unauthenticated remote attacker can send crafted serialized data to a public site, which may allow manipulation of server-side processing and, depending on the PHP classes available on the site, code execution or other serious impact. The CVSS base score is 9.8 (critical); the actual impact per site could not be verified.
Affected
- Quirky WordPress theme, versions up to and including 1.23
- Vendor and version details are partly unverified; the original developer could not be confirmed
Fixed in
Unknown. No fixed version or vendor advisory was found.
Workaround
- Verify whether the Quirky theme is installed and active on any WordPress site
- Use a web application firewall or virtual patching service where available; coverage of this specific CVE is unverified
- Restrict access to administrative areas as far as practical
Exploitation
- Unauthenticated and network-reachable, low attack complexity
- Not listed in CISA KEV at time of research; EPSS not yet published
- No public proof of concept found; exploitation in the wild unknown
Our recommendation
- Check immediately whether any internet-facing site uses Quirky version 1.23 or earlier
- Since no fix is confirmed, remove the theme and switch to a maintained replacement
- If removal is not possible, apply virtual patching and monitor Patchstack and CISA KEV for updates
- Review site logs for suspicious requests to the theme
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack vulnerability record patchstack.com
- Vulners CVE record vulners.com
- Strix CVE record www.strix.ai
- CVE threat intelligence record cve.threatint.com
- GitHub CVE tracking issue github.com
- Wordfence advisory for related Quirky issue www.wordfence.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:04.
Original description (NVD)
Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.