CVE-2026-27083: Work & Travel Company WordPress Theme PHP Object Injection via Deserialization
CVE-2026-27083 is a deserialization of untrusted data weakness (CWE-502) in the work-travel-company theme by ThemeREX, affecting Work & Travel Company versions up to and including 1.2 as described in the record. The CNA Patchstack scored it 9.8 (critical) under CVSS 3.1 with network attack vector and no privileges or user interaction required. No confirmed exploitation appears in the sources consulted, and no fixed version is listed in the available record.
Overview
CVE-2026-27083 describes a deserialization of untrusted data weakness, classified as CWE-502, in the work-travel-company WordPress theme published by ThemeREX. The record states that the flaw allows object injection. It was published on 2026-03-25 and assigned by the CNA Patchstack.
Impact
According to the CVSS 3.1 vector supplied by the CNA, the flaw is network-reachable, requires no privileges and no user interaction, and carries high confidentiality, integrity and availability impact. The base score is 9.8. Object injection through unsafe deserialization can, in general terms, let an attacker influence application objects, but the record does not describe the specific consequences in this theme.
Affected products and versions
- Product: Work & Travel Company (work-travel-company), a WordPress theme by ThemeREX.
- Affected range as stated in the record: from n/a through 1.2 inclusive.
The record contains no structured affected or fixed version data, so the exact boundaries of the range are not verifiable from the sources consulted.
Exploitation status
The CISA KEV catalog does not list this CVE in the record. No confirmed active exploitation appears in the sources consulted. The EPSS probability is 0.00564 (percentile 0.45334), dated 2026-10-13, which is a statistical estimate and not evidence of exploitation.
Remediation and mitigation
- Identify every site running the Work & Travel Company theme and its exact version.
- Check the vendor or Patchstack advisory for an updated release, since the record does not list a fixed version.
- Until a fix is verified, consider restricting exposure of the affected site, reviewing web application firewall rules for the theme, and limiting administrative access.
- Keep WordPress core, plugins and other themes updated, and remove unused themes.
Detection guidance
- Inventory installed themes and compare versions against the range described in the record.
- Review web server and application logs for unusual requests to theme components, and for unexpected changes to site content or administrative accounts.
- Monitor for new vendor advisories referencing this CVE.
Limitations of the available information
The record provides no fixed version, no affected version list beyond the range statement, no vulnerable component or endpoint names, and no patch details. The CVSS data comes from the CNA only. The 'n/a' lower bound in the affected range is unclear. Exploitation status is limited to the KEV listing being false and the absence of exploitation reports in the consulted sources.
Frequently asked questions
What is CVE-2026-27083?
It is a deserialization of untrusted data weakness (CWE-502) in the Work & Travel Company WordPress theme by ThemeREX, which the record says allows object injection.
Which versions are affected?
The record states the range is from n/a through 1.2 inclusive. No structured version data is provided, so verify your installed version against the vendor advisory.
Is there a fix?
The record does not list a fixed version. Check the vendor or Patchstack advisory for an update before concluding no fix exists.
Is it being exploited?
The CISA KEV catalog does not list it in this record, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.