Good Homes WordPress theme: PHP Object Injection without authentication
Summary
The Good Homes WordPress theme up to version 1.3.13 is vulnerable to PHP Object Injection through unsafe deserialization of data. An unauthenticated remote attacker can exploit this over the network by sending crafted input to a public website. Depending on the PHP classes available on the site, this can lead to manipulation of data or code execution on the server.
Affected
- Good Homes WordPress theme, versions up to and including 1.3.13
- VulDB lists the range as 1.3.0 through 1.3.13; the vendor's exact affected range is unverified.
Fixed in
- Unknown. No vendor advisory or changelog entry confirming a security fix was found.
- A '1.3.14' heading appears on the ThemeForest page, but it is not confirmed as a fix for this vulnerability.
Workaround
- No vendor or researcher workaround known.
- Disable the theme if it is not needed.
- Restrict access to the site at WAF or hosting level, or use a virtual patch if available from your WAF or Patchstack.
Exploitation
- Patchstack rates the issue as high priority and expects exploitation; CISA SSVC lists exploitation as none, automatable as yes, technical impact as total.
- No public proof of concept or exploit is known according to VulDB.
- No evidence of active exploitation found; CISA KEV status should be checked directly.
Our recommendation
- Check whether an internet-facing WordPress site uses the Good Homes theme and which version is installed.
- If the theme is present and no confirmed fix is available, disable or remove it, or restrict access via WAF or hosting.
- Contact ThemeREX or check the Patchstack advisory for the patched release and apply it as soon as it is confirmed.
- Monitor web server logs for unusual requests and audit other WordPress themes for similar issues.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- VulDB entry vuldb.com
- Patchstack advisory (mirror) vulners.com
- Strix CVE summary www.strix.ai
- ThemeForest product page themeforest.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:52.
Original description (NVD)
Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.