Bonbon WordPress theme: Unauthenticated PHP Object Injection

Summary

The WordPress theme Bonbon up to and including version 1.11 is affected by an unauthenticated PHP Object Injection vulnerability (CWE-502). An attacker can send crafted input to a public website without logging in, which can lead to manipulation of server-side processing and potentially to remote code execution. No official fix is known and no confirmed exploitation has been reported so far.

Affected

• Bonbon WordPress theme (ThemeREX, sold on ThemeForest) versions up to and including 1.11
• Note: the naming differs across sources (VulDB lists a plugin); Patchstack classifies it as a theme

Fixed in

Unknown. No official patch confirmed by the vendor; newer Bonbon versions exist in listings but are not confirmed to fix this issue.

Workaround

• Deactivate and remove the theme if it is not needed
• If it must remain, apply a WAF or virtual patching (Patchstack offers a mitigation rule)
• Restrict access to the site where feasible
• Check for unknown admin accounts and unexpected files
• Create a backup before any change

Exploitation

• No confirmed exploitation in the wild found at the time of research
• No public proof-of-concept found
• Not listed in CISA KEV according to a third-party tracker (not independently verified)
• Patchstack expects exploitation and classifies the issue as high priority

Our recommendation

• Identify all WordPress sites running Bonbon version 1.11 or older
• Remove or deactivate the theme where possible
• Where it cannot be removed, apply WAF or virtual patching and restrict access
• Check the sites for compromise (unknown admin accounts, unexpected files)
• Verify a fixed version with ThemeREX/ThemeForest before updating
• Monitor for a vendor fix and any public proof-of-concept

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• ThemeREX Bonbon (ThemeREX) themerex.net
• ThemeForest Bonbon listing themeforest.net
• VulDB entry vuldb.com
• Threat intelligence mirror (CVE record text) cve.threatint.com
• Third-party tracker (KEV status) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:57.