Preservation WordPress theme: Unauthenticated PHP Object Injection
Summary
The Preservation WordPress theme up to and including version 1.15 contains an unauthenticated PHP object injection flaw (CWE-502). An unauthenticated remote attacker can supply crafted serialized data that the theme processes, which can manipulate application logic and may lead to further actions on the server. Whether code execution is possible depends on gadget chains available in other installed plugins or themes, which is not confirmed for this theme. The NVD score is 9.8 (Critical), but the NVD record is still in Deferred status.
Affected
- Preservation WordPress theme, versions <= 1.15
- Vendor and developer: Unknown.
Fixed in
Unknown. No patched version was found in the sources reviewed; no official patch is listed by Patchstack.
Workaround
- No vendor mitigation found.
- Deactivate the theme and switch to a maintained, patched theme if available.
- Apply a WAF or virtual patch in front of the site (coverage for this CVE not verified).
- Restrict access to the admin area.
Exploitation
- Exploited in the wild: Not found. One aggregator marks the CVE as not in KEV; the CISA KEV catalog was not checked directly.
- Public proof of concept: Not found.
- CISA SSVC: Exploitation none, automatable yes, technical impact total.
- Patchstack expects exploitation and notes mass-exploit campaigns for this bug class.
Our recommendation
- Check whether any WordPress site runs the Preservation theme and confirm the installed version.
- Treat internet-facing sites with this theme as high priority.
- If no fix exists, deactivate the theme or apply a virtual patch.
- Monitor for a public PoC, KEV listing, and NVD status changes.
- Re-check the Patchstack advisory for a fixed version.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- Vulners CVE record vulners.com
- Vulners Patchstack entry vulners.com
- Patchstack PHP Object Injection academy patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:03.
Original description (NVD)
Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.