Ozisti WordPress theme: Unauthenticated PHP Object Injection

Summary

The Ozisti WordPress theme up to and including version 1.1.10 contains an unauthenticated PHP Object Injection vulnerability (CWE-502). An attacker can send crafted serialized data to the site, which can manipulate how the application processes data and potentially run harmful actions on the server. No login is required, and the NVD rates the issue as critical (CVSS 3.1 9.8), although other scoring sources differ.

Affected

• Ozisti WordPress theme up to and including 1.1.10
• Other versions: Unknown.

Fixed in

• Unknown. Version 1.1.11 is listed in the vendor changelog but is not confirmed by Patchstack or the vendor to fix this CVE.

Workaround

• No vendor or Patchstack workaround known.
• Patchstack has reportedly issued a mitigation rule; availability for your setup is unverified.

Exploitation

• No evidence of exploitation in the wild found; not listed in CISA KEV.
• No public proof-of-concept found. Patchstack classifies the vulnerability as high priority and expects exploitation.
• Exploitability depends on available POP chains in other installed code, which was not assessed.

Our recommendation

• Check immediately whether any internet-facing WordPress site uses the Ozisti theme and identify its version (WordPress admin or style.css).
• Disable or remove the theme if it is not in active use.
• Restrict public access where possible and apply a WAF rule that filters deserialization-style input; test it first.
• Verify version 1.1.11 in a staging environment or obtain written confirmation from ThemeREX before updating production.
• Review other installed plugins and themes for POP chains and update them.
• Monitor web server logs for suspicious serialized payloads.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• Vulners CVE record vulners.com
• VulDB entry vuldb.com
• ThemeForest Ozisti item page themeforest.net
• Vulners Patchstack record vulners.com
• GitHub issue (exploitation status) github.com
• Strix CVE mirror www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:03.