Qwery WordPress theme: Unauthenticated PHP Object Injection
Summary
The Qwery WordPress theme by AncoraThemes (ThemeREX), versions up to and including 3.6.1, contains a PHP Object Injection flaw (CWE-502) that can be triggered without authentication over the network. An attacker can supply crafted serialized data to manipulate how the site processes input, which may lead to file deletion, data retrieval or code execution if a suitable gadget chain is present in the installed plugins or themes. Patchstack rates the issue as high priority with a CVSS 3.1 base score of 9.8.
Affected
- Qwery WordPress theme up to and including 3.6.1
- Other versions: Unknown.
Fixed in
- Unknown. No vendor advisory naming a fixed build was found.
- The vendor changelog for 3.7.0 (15.04.2026) mentions fixing a potential Object Injection during unserialize of skin and scheme options, but this has not been confirmed as the fix for CVE-2026-78533.
Workaround
- No vendor-published workaround found.
- Deactivate or remove the theme if no fixed build is confirmed.
- Place the site behind a web application firewall or use virtual patching, as Patchstack has issued a mitigation rule.
Exploitation
- CISA SSVC (Vulnrichment): exploitation none, automatable yes, technical impact total.
- Not listed in CISA KEV.
- EPSS 0.00328 (Vulners).
- No public proof of concept found.
- Patchstack expects exploitation and notes mass-exploit campaigns are likely.
Our recommendation
- Check whether any site uses the Qwery theme and which version is installed.
- Update to the latest vendor build and confirm in writing with AncoraThemes/ThemeREX that it fixes CVE-2026-78533.
- If no fix is confirmed or the theme is unused, deactivate or replace it and use a WAF or virtual patching.
- Review logs for unusual unserialize-related requests and unexpected admin or file changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory (referenced, not retrieved) patchstack.com
- OpenCVE CVE-2026-78533 app.opencve.io
- Vulners RAPID7:CVE-2026-78533 vulners.com
- VulDB CVE-2026-78533 vuldb.com
- Qwery theme on ThemeForest (vendor changelog) themeforest.net
- ThemeREX Qwery documentation doc.themerex.net
- Liquid Web WordPress vulnerability report, September 2025 www.liquidweb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:21.
Original description (NVD)
Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.