Gamic WordPress Theme: Unauthenticated PHP Object Injection
Summary
The Gamic WordPress theme up to version 1.19 is vulnerable to PHP Object Injection (CWE-502), which can be triggered without authentication over the network. An attacker can manipulate how the site processes serialized data, which may allow harmful actions on the server. Whether this leads to code execution or data compromise depends on other installed plugins or themes that provide exploitable gadget chains; this is not established for the theme alone.
Affected
- Gamic WordPress theme, versions 1.19 and earlier (per Patchstack and NVD)
- Note: VulDB describes the product as a plugin; Patchstack and the ThemeForest listing identify it as a theme.
Fixed in
Unknown. No confirmed fixed version. The ThemeForest changelog mentions a PHP Object Injection fix in trx_addons_decode_settings() in entries for versions before 1.19.0 and before 1.21.0, but it is unverified whether this is the same issue.
Workaround
- No vendor-confirmed workaround.
- Restrict access to admin and sensitive endpoints where possible.
- Use a web application firewall in front of the site; Patchstack reports a mitigation rule is available.
Exploitation
- Not listed in CISA KEV at the time of research.
- No public proof of concept or confirmed exploitation found in the sources reviewed.
- Patchstack rates the priority as high and expects exploitation, based on the vulnerability class.
Our recommendation
- Check whether the Gamic theme is installed and which version is active.
- If a version of 1.19 or earlier is in use on a public site, update to the newest version from ThemeForest and confirm it is newer than 1.19 and contains the fix in its changelog.
- If no fix can be confirmed, consider replacing or disabling the theme and enable WAF virtual patching.
- Review other installed plugins and themes for known vulnerabilities, since they may enable exploitation.
- Monitor the site and server logs for unusual requests with serialized data.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- Vulners CVE record vulners.com
- VulDB entry vuldb.com
- Strix NVD mirror www.strix.ai
- ThemeForest listing themeforest.net
- Envato Elements listing elements.envato.com
- Gamic documentation gamic.themerex.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:52.
Original description (NVD)
Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.