ThemeREX Partiso theme: PHP Object Injection via untrusted deserialization

Summary

The WordPress theme Partiso by ThemeREX Group, versions up to and including 1.1.13, deserializes untrusted data without sufficient checks. An unauthenticated remote attacker can inject PHP objects, which can allow manipulation of server-side processing and execution of malicious PHP code. Exploitation requires no login and no user interaction, and the CVSS score is 9.8 (Critical).

Affected

• Partiso WordPress theme (ThemeREX Group), all versions up to and including 1.1.13
• Versions prior to 1.1.13 are included in the affected range as stated by the CNA

Fixed in

• Unknown. No vendor or Patchstack statement names a fixed release.
• Check the ThemeForest item changelog and ThemeREX for a fixed version later than 1.1.13.

Workaround

• Unknown. The NVD record contains no solution or workaround.
• If the theme is not in active use, deactivate and remove it.
• If it is in use, restrict access to admin and REST surfaces where possible and apply web application firewall rules for virtual patching if the provider offers them.

Exploitation

• CISA SSVC: Exploitation none, automatable yes, technical impact total.
• Not listed in the CISA KEV catalogue. No known exploitation in the wild found.
• No public proof of concept known, not independently verified.
• Patchstack describes the issue as high priority and expects exploitation.

Our recommendation

• Identify whether any WordPress site uses the Partiso theme, especially internet-facing sites.
• Deactivate and remove the theme if it is not needed.
• Take a fresh backup and review for unexpected files or admin accounts.
• Apply a vendor fix or virtual patch as soon as one is confirmed, and monitor the vendor and NVD for updates.
• Check separately for the related unauthenticated local file inclusion issue in Partiso themes up to 1.18.0.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• VulDB entry vuldb.com
• OpenCVE entry app.opencve.io
• Vulners CVE list entry vulners.com
• Wordfence related local file inclusion advisory www.wordfence.com
• OffSeq Radar entry radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:56.