CVE-2026-81797: ThemeREX Buzz Stone WordPress Theme - Unauthenticated PHP Object Injection
An unauthenticated PHP Object Injection vulnerability (CWE-502) affects the Buzz Stone | Magazine & Viral Blog WordPress theme up to and including 1.0.2, as described by Patchstack. The record assigns a critical CVSS base score of 9.8, but it lists no fixed version and no confirmed exploitation in the CISA KEV catalog.
Overview
The Buzz Stone | Magazine & Viral Blog WordPress theme from ThemeREX is affected by an unauthenticated PHP Object Injection vulnerability classified as CWE-502 (Deserialization of Untrusted Data). The record describes affected versions up to and including 1.0.2 and was published through the Patchstack CNA. The source status in the record is Deferred.
Impact
- The record assigns a CVSS base score of 9.8 with a critical severity rating.
- The associated vector indicates network reachability, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
- Deserialization of attacker-controlled data can allow unintended object behavior. The specific impact in a given site depends on the code paths and available classes, which the record does not describe.
Affected products and versions
- Product: ThemeREX Buzz Stone | Magazine & Viral Blog WordPress Theme.
- Affected range: up to and including 1.0.2.
- Fixed version: not listed in the record.
Exploitation status
The CISA KEV catalog does not list this CVE according to the record. No confirmed exploitation appears in the sources consulted. The SSVC exploitation field is recorded as none, and the EPSS probability is 0.0032 with a percentile of 0.23769, dated 2026-10-23.
Remediation and mitigation
- Check whether the theme is installed and active on any WordPress site. If it is not needed, deactivate and remove it.
- Consult the vendor and the Patchstack entry for an updated release, since no fixed version appears in the record.
- Until a fix is verified, limit exposure of the affected site, keep WordPress core and other components updated, and consider web application firewall protections recommended by your security provider.
- Review custom code that processes untrusted input with deserialization functions.
Detection guidance
- Review web server and application logs for unusual requests to theme-related endpoints or unexpected payloads.
- Monitor for unexpected file changes, newly created administrator accounts and unusual outbound connections from the web server.
Limitations of the available information
- The record does not provide a fixed version, the vulnerable component or endpoint, or vendor advisory text.
- Exploitability in a specific site depends on its configuration, which is not available here.
Frequently asked questions
Which versions of the Buzz Stone theme are affected?
The record lists the ThemeREX Buzz Stone | Magazine & Viral Blog WordPress Theme up to and including 1.0.2 as affected.
Is there a fixed version available?
The record does not list a fixed version. Check the vendor and the Patchstack entry for an update.
Is this vulnerability known to be exploited in the wild?
The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
What should site owners do now?
Remove the theme if it is not needed, keep WordPress components updated, and monitor logs and file changes while waiting for a verified fix.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.