Executive Summary

CVE-2026-23542 is a high-priority PHP Object Injection vulnerability found in the WordPress Grand Restaurant Theme versions up to and including 7.0.10.

This vulnerability allows unauthenticated attackers to inject malicious PHP objects, which can lead to various harmful actions such as code injection, SQL injection, path traversal, and denial of service.

The issue arises from deserialization of untrusted data, enabling attackers to exploit the theme if a suitable PHP Object Injection POP chain is available.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including allowing attackers to execute arbitrary code on your server, manipulate or access your database through SQL injection, traverse directories to access unauthorized files, and cause denial of service conditions.

Because the vulnerability can be exploited by unauthenticated attackers, it poses a significant risk to the security and availability of websites using the affected theme.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability is a PHP Object Injection issue affecting the WordPress Grand Restaurant Theme up to version 7.0.10. Detection typically involves monitoring for exploitation attempts such as unusual HTTP requests that may include serialized PHP objects or payloads attempting code injection, SQL injection, or path traversal.'}, {'type': 'paragraph', 'content': 'While no specific detection commands are provided, administrators can use web server logs and intrusion detection systems to look for suspicious POST or GET requests containing serialized PHP objects or unusual parameters targeting the theme.'}, {'type': 'paragraph', 'content': "Additionally, applying Patchstack's mitigation rule can help detect and block attack attempts targeting this vulnerability."}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and recommended mitigation step is to update the WordPress Grand Restaurant Theme to version 7.0.11 or later, where this vulnerability has been patched.

Until the update can be applied, it is advised to implement the mitigation rule provided by Patchstack to block attacks targeting this vulnerability, providing rapid protection for affected websites.

Useful 0 Not Useful 0