ThemeREX Smash theme: PHP object injection via untrusted deserialization
Summary
The Smash WordPress theme by ThemeREX Group contains a deserialization flaw that allows PHP object injection. An unauthenticated remote attacker can send crafted data to a public site and may be able to execute harmful actions on the server, depending on the gadget classes available in the site's code. The CVSS score is 9.8 (critical), and the advisory details are not public.
Affected
- Smash WordPress theme, all versions up to and including 1.12.0 (according to the CVE record and Patchstack)
Fixed in
Unknown. No vendor or Patchstack statement names a fixed version. Do not assume that any version is safe.
Workaround
- Check the installed Smash version in the WordPress admin. If it is 1.12.0 or older, treat the site as vulnerable.
- If the theme is not needed, switch to another theme and remove Smash after checking that the site still works.
- If the site must stay online, restrict or monitor access and review logs for unusual requests.
Exploitation
- No confirmed exploitation in the wild, according to the available sources.
- No public proof-of-concept found.
- Not listed in CISA KEV. EPSS is about 0.003.
- Patchstack expects exploitation and rates the priority as high. CISA SSVC lists automatable: yes.
Our recommendation
- Inventory all WordPress sites running Smash and record the exact version.
- Prioritise internet-facing sites. Restrict access or take the theme offline if it is not needed.
- Ask ThemeREX and Patchstack for a fixed version and the advisory text, and do not rely on an unverified fix.
- Monitor logs for unusual requests and recheck the Patchstack page and NVD for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- Vulners CVE record (CVELIST) vulners.com
- VulDB CVE entry vuldb.com
- Strix CVE entry www.strix.ai
- OpenCVE entry app.opencve.io
- ThemeREX Smash documentation doc.themerex.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:55.
Original description (NVD)
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.