BuddhaThemes Neo Barber Shop WordPress Theme: PHP Object Injection

Summary

The Neo | Barber Shop WordPress Theme (neocut) up to and including version 3.5 contains a deserialization of untrusted data flaw (CWE-502) that allows PHP Object Injection. An attacker with low privileges on a WordPress site using the theme could manipulate serialized data to influence server-side processing, potentially leading to code execution, data access or data manipulation. Patchstack rates the issue as high priority, and the CVSS score is 8.8.

Affected

• BuddhaThemes Neo | Barber Shop WordPress Theme (neocut), versions 0 to 3.5 inclusive
• Later versions: unclear, the vendor has not confirmed which version contains the fix

Fixed in

• Unknown. No vendor advisory or confirmed patched version was found.
• The ThemeForest changelog lists a 3.8 entry marked "Security Issues Fixed", but it is not confirmed that this addresses CVE-2026-94064.

Workaround

• No vendor-confirmed workaround available.
• Disable or remove the theme if it is not in active use.
• Restrict or remove accounts with login rights.
• Restrict admin access by IP allowlist or VPN and monitor for unexpected account or admin changes.
• Keep WordPress core, plugins and PHP up to date.

Exploitation

• CISA KEV: not listed.
• Public proof of concept: none found in the searches performed.
• In-the-wild exploitation: none reported in the sources reviewed.
• Patchstack considers exploitation expected; CISA SSVC lists exploitation as none and automatable as no.
• EPSS around 0.0028 (low).

Our recommendation

• Inventory all WordPress sites using this theme and check the installed version.
• Ask BuddhaThemes in writing which version contains the fix and obtain it through the ThemeForest account.
• If no fix is confirmed, disable the theme and plan removal or replacement.
• Restrict low-privilege accounts and monitor logs for suspicious activity until the issue is resolved.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• CISA KEV status source (GitHub issue) github.com
• CVE record (Vulners) vulners.com
• CVE CNA record (Vulners CVEList) vulners.com
• Patchstack record (Vulners) vulners.com
• ThemeForest product page themeforest.net

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:54.