Buzz Stone WordPress Theme: Unauthenticated PHP Object Injection
Summary
The Buzz Stone | Magazine & Viral Blog WordPress theme in versions 1.0.2 and earlier contains an unauthenticated PHP Object Injection flass (CWE-502). An attacker can send crafted serialized data to the site without logging in, which may allow manipulation of server-side processing and, depending on the code and plugins present, remote code execution. Patchstack rates this as high priority and expects exploitation, but no exploitation is confirmed in the sources reviewed.
Affected
- Buzz Stone | Magazine & Viral Blog WordPress Theme, versions 1.0.2 and earlier
- Vendor naming is unconfirmed: ThemeRex or AncoraThemes
Fixed in
Unknown. No vendor patch was found for this CVE. Do not assume version 1.0.3 or later is safe without checking the vendor changelog and Patchstack.
Workaround
- Deactivate and remove the theme if it is not needed.
- Apply virtual patching or WAF rules for unauthenticated requests to the theme, if available for this CVE.
- Have a developer review or replace the vulnerable code paths.
Exploitation
- CVSS 9.8, network-reachable, no login and no user interaction required.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
- Not in CISA KEV. EPSS 0.00311.
- No public proof of concept found and no in-the-wild exploitation known; this does not prove none exists.
Our recommendation
- Treat as high priority.
- Inventory all WordPress sites using this theme and check whether it is active.
- Deactivate or remove the theme where possible; if needed, plan migration to a maintained theme.
- Apply virtual patching if available, and review sites for signs of compromise.
- Keep WordPress, PHP and all plugins patched.
- Re-check the Patchstack page and NVD for a vendor fix, since NVD analysis is still deferred.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-81797 patchstack.com
- ThemeForest product page themeforest.net
- OpenCVE CVE-2026-81797 app.opencve.io
- VulDB CVE-2026-81797 vuldb.com
- Vulners RAPID7 CVE-2026-81797 (EPSS) vulners.com
- Strix CVE-2026-81797 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:23.
Original description (NVD)
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.