CVE Intelligence
Analysis AI-assisted

CVE-2026-27082: ThemeREX Love Story WordPress Theme - Object Injection via Deserialization

A deserialization of untrusted data flaw (CWE-502) in the ThemeREX Love Story WordPress theme allows Object Injection, according to the CVE record. The CNA rates it critical with a CVSS 3.1 base score of 9.8, and the affected range runs through 1.3.12. The record lists no structured fixed version and no CISA KEV listing.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A deserialization of untrusted data weakness (CWE-502) was reported in the Love Story theme by ThemeREX for WordPress. The record describes it as allowing Object Injection, and the Patchstack advisory is the main vendor-side reference listed.

Impact

  • The CNA assessed the issue with a CVSS 3.1 base score of 9.8 (critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • Under that vector, the record indicates high impact to confidentiality, integrity and availability, with no privileges or user interaction required.
  • The record does not describe the specific consequences of the object injection in this product.

Affected products and versions

  • Product: Love Story by ThemeREX, a WordPress theme.
  • Affected range per the record: from n/a (no lower bound given) through 1.3.12, inclusive.
  • The record contains no structured affected or fixed version entries.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • No confirmed exploitation appears in the sources consulted.
  • The record gives an EPSS probability of 0.00564 and a percentile of 0.45335.

Remediation and mitigation

  • Check the Patchstack advisory and the vendor for a release newer than the affected range, then apply it.
  • If the theme is not needed, deactivate and remove it from production sites.
  • Restrict administrative access and keep WordPress core and other components current as general hardening.

Detection guidance

  • Inventory sites running the Love Story theme and record the installed version of each.
  • Review web server and application logs for anomalous requests directed at theme components.
  • Monitor for unexpected changes to theme files and configuration.

Limitations of the available information

  • The record does not list fixed versions, so whether a patched release exists is unknown from the record alone.
  • Exploitation prerequisites and the specific vulnerable component are not described.
  • CVSS and EPSS values are reported as provided and were not independently verified.

Frequently asked questions

What is the vulnerability in CVE-2026-27082?

It is a deserialization of untrusted data weakness (CWE-502) in the ThemeREX Love Story WordPress theme that allows Object Injection, according to the CVE record.

Which versions are affected?

The record states the affected range runs from n/a through 1.3.12. It contains no structured list of affected or fixed versions, so check the vendor and Patchstack advisory for current details.

Is this vulnerability known to be exploited?

The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.