CVE Intelligence
Analysis AI-assisted

CVE-2026-27084: ThemeREX Buisson WordPress Theme: Insecure Deserialization (Object Injection)

The record describes an insecure deserialization of untrusted data flaw (CWE-502) in the ThemeREX Buisson theme that allows object injection. The CNA Patchstack reports a CVSS 3.1 base score of 9.8 for versions up to and including 1.1.11. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-27084 is classified as CWE-502 (Deserialization of Untrusted Data) and affects the ThemeREX Buisson theme. The reference URL indicates a WordPress theme listed in the Patchstack database. The description states that the flaw allows object injection.

Impact

  • The CNA Patchstack assigns a CVSS 3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates a network-reachable issue requiring no privileges or user interaction, with high confidentiality, integrity and availability impact as scored.
  • Object injection flaws can allow attackers to influence application logic when untrusted data is deserialized. The exact outcome depends on the code paths and environment, which the record does not describe.

Affected products and versions

  • Product: ThemeREX Buisson (buisson) theme.
  • Affected range stated in the description: from n/a through 1.1.11 (less than or equal to 1.1.11).
  • The structured affected list in the record is empty, so the vendor-confirmed range should be verified against the vendor or Patchstack page.

Exploitation status

The CISA KEV entry is not listed. No confirmed active exploitation appears in the sources consulted. The EPSS probability is 0.00564 (percentile 0.45334), as recorded in the data.

Remediation and mitigation

  • Identify all installations of the Buisson theme and confirm their version.
  • Plan an update to a version newer than 1.1.11. The record does not list a fixed version, so confirm the fixed release with the theme vendor or the Patchstack advisory before relying on it.
  • Where an update cannot be applied immediately, reduce exposure by restricting access to administrative and non-essential endpoints and by removing the theme if it is unused.
  • Keep backups and test updates in a staging environment first.

Detection guidance

  • Review web server and application logs for unusual requests to theme-related components and for unexpected changes to site files or the database.
  • Monitor for unexpected administrative account creation or configuration changes.
  • Use vulnerability scanning and asset inventory to track whether the theme is present.

Limitations of the available information

  • The record does not provide a fixed version, a structured affected version list, or details of the vulnerable code path.
  • The EPSS date in the record (2026-10-13) is later than the publication date (2026-03-25), so the timing of the score should be treated with caution.
  • The NVD and CVE Record pages were listed as sources but their content is not reproduced here beyond the record fields.

Frequently asked questions

What is CVE-2026-27084?

It is an insecure deserialization of untrusted data flaw (CWE-502) in the ThemeREX Buisson theme that allows object injection, as described in the record.

Which versions are affected?

The description states the range is from n/a through 1.1.11. The structured affected list in the record is empty, so confirm the range with the vendor or Patchstack.

Is this vulnerability being actively exploited?

The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.