Muzicon WordPress theme: Unauthenticated PHP Object Injection

Summary

The Muzicon WordPress theme up to and including version 1.15 contains a PHP Object Injection flaw (CWE-502) that can be triggered without authentication over the network. An attacker who sends crafted serialized data to a vulnerable site may be able to manipulate how the application processes data and run harmful actions on the server. The actual impact depends on the gadget chains available in the installed plugins, which has not been assessed.

Affected

• Muzicon WordPress theme, versions up to and including 1.15
• Vendor listed as ThemeREX (not independently confirmed for this version)

Fixed in

Unknown. No fixed version or vendor patch was found at the time of research.

Workaround

• Deactivate or replace the Muzicon theme on internet-facing sites
• If removal is not possible immediately, place a WAF rule in front of the site and restrict admin access
• Virtual patching is only an option if your protection provider confirms coverage for this CVE

Exploitation

• CISA KEV: not listed
• Public proof of concept: none found in the sources checked
• Exploited in the wild: unknown, no confirmed reports found
• EPSS: not yet published

Our recommendation

• Inventory all WordPress sites, including staging and dormant sites, and record whether the Muzicon theme is installed and its version
• Remove or replace the theme on internet-facing sites, prioritising these
• Check the Patchstack advisory directly for a patched version before final decisions
• Monitor web server logs for suspicious requests and re-check for a vendor patch and public PoC in one to two weeks

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• Vulners CVE record vulners.com
• Threatint CVE record cve.threatint.com
• Strix CVE record www.strix.ai
• GitHub triage record (KEV status, EPSS) github.com
• Vulners Patchstack record vulners.com
• OpenCVE record for related Muzicon CVE app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:54.