Smart Casa WordPress theme: PHP Object Injection via untrusted data deserialization

Summary

The Smart Casa WordPress theme in versions up to and including 1.0.12 deserializes untrusted data, which allows PHP Object Injection. According to the Patchstack entry, an attacker can manipulate how the site processes data to run harmful actions on the server. The CVSS vector indicates network access without authentication or user interaction, with high impact on confidentiality, integrity and availability; the exact trigger path has not been confirmed from the sources.

Affected

• Smart Casa WordPress theme, versions 0 up to and including 1.0.12 (per CNA record)
• Vendor naming differs between sources (ThemeREX Group / AxiomThemes); not resolved

Fixed in

Unknown. No fixed version or vendor advisory was found.

Workaround

• Verify the installed theme version; 1.0.12 or lower is affected.
• If no fix is available, remove or disable the theme.
• Restrict access to the site admin and theme-related endpoints where feasible.
• Generic measures from third parties (not vendor guidance): a web application firewall to block serialized-object payloads and least-privilege file system access for the web server user.

Exploitation

• No confirmed exploitation in the wild; CISA SSVC lists exploitation as none, automatable as yes, technical impact as total.
• Patchstack expects exploitation and notes mass-exploit campaigns are typical for this class of flaw.
• No public PoC found in the sources checked; EPSS is about 0.003.

Our recommendation

• Inventory WordPress sites that use Smart Casa and confirm the installed version.
• Apply any vendor update when available; if none exists, remove or disable the theme.
• Use a WAF or Patchstack virtual patch as a temporary mitigation and monitor logs for suspicious serialized payloads.
• Obtain the Patchstack details to confirm the trigger path and exposure.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack vulnerability entry patchstack.com
• CVE record (CNA JSON) raw.githubusercontent.com
• ThemeForest product page themeforest.net
• OpenCVE entry app.opencve.io
• VulDB entry vuldb.com
• CIRCL via Vulners vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:56.